@hearsay-tools/squawk 0.0.0-stage → 0.17.0-dev.5685

package/dist/runs/store.js

@@ -0,0 +1,3516 @@
+import { legacyIndexRows } from './legacy-run-rows.js';
+import { dataReadDirs } from '../project-paths.js';
+import { addRunSource, copyFallbackFamily, fallbackRunSource, bindWorkerResultPath, fallbackRunDeleteError, workerResultsDirectory } from './project-run-sources.js';
+import { productName, logPrefix } from '../home/display.js';
+import { productEnv } from '../core/product-env.js';
+import { registeredWaitRecord, registeredReceiptRecord } from './wait-registration-write.js';
+import { reportsIndex } from '../artifacts/reports-index.js';
+import { stageCommit, stageLoaded, stageDurableUpdate, stageDebouncedUpdate, stageConversation, stageArchiveFields, stagePullRequests, stageStepUpdate, redactPatch, redactText, clearPin } from './record-write-rules.js';
+import { workerDeletionProof } from './worker-deletion-proof.js';
+import { workerResourceAbsentHolders, workerResourceAuthorized, workerResourceLiveHolders, workerResourcePathsGone } from './worker-resource-holders.js';
+import { listPeerTaskSummaries, parseStoredSummary } from './run-summary-page.js';
+export { parseStoredSummary } from './run-summary-page.js';
+import { defined } from '../core/defined.js';
+import { autosaveCleanupBlocker, clearAutosaveCleanup } from '../autosave-cleanup.js';
+import { EventEmitter } from 'node:events';
+import { workerEvidenceRunIds, workerExecutionSchema } from './worker-execution.js';
+import { agentTmpDirLocations, agentTmpDirMayExist, agentTmpDirOwnershipProven, removeAgentTmpDir } from './agent-tmpdir.js';
+import { removeArtifacts } from '../artifacts/lifecycle.js';
+import { randomUUID, createHash } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+import { appendFileSync, closeSync, constants, fstatSync, fsyncSync, lstatSync, openSync, readSync, realpathSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { z } from 'zod';
+import { agentInputSchema, inboxClaimSchema, delegationStateSchema, workerResultFileSchema, workerDestroyRetrySchema, } from '../contract/index.js';
+import { automationIdOf, stepStateSchema as contractStepStateSchema, queuedMessageSchema, toRunSummary, runRecordSchema as contractRunRecordSchema, runPullRequestSchema, mergedPullRequestSchema, } from '../contract/index.js';
+import { previewServerSchema } from '../contract/index.js';
+import { isUsageLimitHold, waitSchema, } from '../contract/index.js';
+import { UNREAD_RUN_RULE, SWEEPABLE_RUN_RULE, RETENTION_RUN_RULE, REFERENCED_RUN_RULE } from '../contract/index.js';
+import { matchesRunSearch, sqlPrefilterTokens } from '../contract/index.js';
+import { storedDelegationStateSchema } from './delegation-state.js';
+import { HistoryCompressor } from './history-compressor.js';
+import { LiveItemSnapshots } from './live-item-snapshots.js';
+import { emptyFacts, stampOf, TranscriptFactsIndex } from './transcript-facts.js';
+import { hasPlainHistory, historyPaths, readHistoryText, readHistoryTextAsync, removeHistory, restoreHistory } from './history-file.js';
+import { workerExecutionIdentitySchema } from '../delegation/execution-identity.js';
+import { inspectGeneration, processStartToken } from '../delegation/process-liveness.js';
+import { collectSecretValues, redactDeep } from '../core/secret-redaction.js';
+// Pure, dependency-free reference helpers — the same sanity bound the marker parser applies.
+import { archivePullRequests, pullRequestKey } from './pull-requests.js';
+import { isRepoScopedRef, promptNamesRepo, refUrlRepo } from './task-refs.js';
+// Type-only module (zod + nothing else), so this cannot cycle back into the store.
+import { workflowDefSchema } from '../workflows/types.js';
+import { applyOutcomes } from './outcome-commit.js';
+import { ISSUE_URL_RE, originatingIssue, refUrlNumber, referencedPrDeclaration, rescopeRun, resolveIssueReference, resolveReferencedRef, restoreOriginatingIssue, scanEventReferences, trackReferencedIssues, trackReferencedPrs } from './run-references.js';
+import { applyExit, doneCommits, exitDurability, RUN_EXITS } from './run-exits.js';
+import { assertConversationIdFree } from './conversation-identity.js';
+export { ConversationIdInUseError } from './conversation-identity.js';
+import { RUNNER_IDS } from '../core/agent-runner.js';
+import { ARCHIVED_ROOT, RUNS_DB_FILE, RUNS_IMPORT_COMPLETE_KEY, RunConflictError, RunDatabase, RunDatabaseBusyError, } from './run-database.js';
+import { restoreLostReferencedPullRequest } from './loaded-run-healing.js';
+import { failLoadedInterruptedRun, restoreLoadedUsageLimitHold, settleLoadedStop } from './loaded-run-exits.js';
+import { hasLegacyWaitFields, upgradeLegacyWaits, UNREADABLE_WAIT } from './legacy-waits.js';
+export { ciWaitEntry, holdsWorkerWait, upgradeLegacyWaits, workerWaitEntry } from './legacy-waits.js';
+import { ExitEvents } from './exit-events.js';
+import { encodeRunRow, isLiveRecord, isLiveStatus } from './run-row.js';
+import { collectRawExtras, encodeRawRecord } from './raw-record.js';
+import { ColdReadCache, storedRow } from './cold-reads.js';
+import { assertNoLegacyCockpit, assertNoLegacyWriter, backUpLegacyIndex, LEGACY_INDEX_FILE, LegacyWriterError, readLegacyIndex } from './legacy-index.js';
+import { toRunStoreOpenError } from './store-open-error.js';
+import { archiveStoreFamily } from './archive-family.js';
+import { claimStoreFamilies } from './claim-families.js';
+import { createStoreOwnedRun } from './owned-run-create.js';
+import { commitStoreWorkerResult } from './worker-result-commit.js';
+import { claimOwnerLive, closeClaimSession, familyKey, foreignClaimedRunIds, liveForeignClaimedRunIds, openClaimSession, rowFamily } from './run-claims.js';
+import { assertProjectWritable, projectWriteRefused } from '../server/cockpit-ownership.js';
+/**
+ * A runner id as it may appear in a PERSISTED record, normalized to the three
+ * ids the rest of cezar speaks (#547).
+ *
+ * `claude-cli` is the legacy spelling of `claude` — still a member of
+ * `AgentBackend` and still accepted by `createRunner`, and accepted in `runs.json`. The enum
+ * here once failed to accept it: the loader `safeParse`s the
+ * WHOLE array, so one record carrying it would have dropped every run in the
+ * file.
+ *
+ * Parse-and-fold rather than widen: the legacy id is accepted on the way in and
+ * collapsed to `claude`, so no consumer, wire type or contract schema ever sees
+ * a fourth runner. The narrowing is one-way and permanent (the index is
+ * re-serialized from the parsed records), which is what "old run records
+ * normalise identically to `claude`" in `core/model-identity.ts` has always
+ * claimed. Use ONLY for read-back of stored state — request bodies, settings and
+ * workflow step defs stay the three selectable ids (`RunnerId`), because nothing
+ * should be able to ASK for the legacy spelling.
+ */
+const storedRunnerSchema = z
+    .enum([...RUNNER_IDS, 'claude-cli'])
+    .transform((id) => (id === 'claude-cli' ? 'claude' : id));
+const stepStateSchema = contractStepStateSchema.extend({ backend: storedRunnerSchema.optional() });
+/** Exported for `./run-index.ts`, the read-only reader of the same records. Nothing else should
+ *  parse a stored run — see `reconcileLoadedRun` for why a second parser is a correctness risk. */
+export const runRecordSchema = contractRunRecordSchema.extend({
+    delegation: storedDelegationStateSchema,
+    lastWaitsError: contractRunRecordSchema.shape.lastWaitsError.catch(undefined),
+    automaticWakes: contractRunRecordSchema.shape.automaticWakes.catch(undefined),
+    waitDeliveryFailures: contractRunRecordSchema.shape.waitDeliveryFailures.catch(undefined),
+    runner: storedRunnerSchema.optional(),
+    notify: z.boolean().optional().catch(undefined),
+    webhook: contractRunRecordSchema.shape.webhook.catch(undefined),
+    destroyRetry: contractRunRecordSchema.shape.destroyRetry.catch(undefined),
+    stopping: contractRunRecordSchema.shape.stopping.catch(undefined),
+    hasPendingPermission: contractRunRecordSchema.shape.hasPendingPermission.catch(undefined),
+    autoResumeAt: z.string().datetime().optional().catch(undefined),
+    autoResumeAttempts: z.number().int().min(0).optional().catch(undefined),
+    pullRequests: z.preprocess((value) => Array.isArray(value)
+        ? value.flatMap((entry) => {
+            const parsed = runPullRequestSchema.safeParse(entry);
+            return parsed.success ? [parsed.data] : [];
+        })
+        : undefined, z.array(runPullRequestSchema).optional()),
+    worktreeSetup: contractRunRecordSchema.shape.worktreeSetup.catch(undefined),
+    archived: z.boolean().default(false),
+    workflowDef: workflowDefSchema.optional().catch(undefined),
+    steps: z.array(stepStateSchema),
+    automation: contractRunRecordSchema.shape.automation.unwrap().extend({
+        automationRevision: z.number().int().positive(),
+        githubUrl: z.string().url(),
+    }).optional(),
+    automationTrigger: contractRunRecordSchema.shape.automationTrigger.unwrap().extend({
+        automationRevision: z.number().int().positive(),
+    }).optional(),
+    /** The handoff file's autosave records (hearsay-tools/cezarion#1809); unreadable drops the field. */
+    handoffRecords: contractRunRecordSchema.shape.handoffRecords.catch(undefined),
+});
+/** Read legacy wait fields into the wait list and salvage per entry, identically for live stores
+ *  and the read-only workspace index. */
+export function parseRunRecords(raw) {
+    if (Array.isArray(raw))
+        for (const row of raw) {
+            if (!row || typeof row !== 'object')
+                continue;
+            upgradeLegacyWaits(row);
+            // One unreadable wait must not evict the run, nor its readable siblings.
+            for (const key of ['waits', 'lastWaits']) {
+                if (row[key] === undefined)
+                    continue;
+                const entries = Array.isArray(row[key]) ? row[key] : [];
+                const readable = entries.filter((entry) => waitSchema.safeParse(entry).success);
+                if (!Array.isArray(row[key]) || readable.length !== entries.length)
+                    row.lastWaitsError = UNREADABLE_WAIT;
+                if (readable.length)
+                    row[key] = readable;
+                else
+                    delete row[key];
+            }
+            // One unreadable registration must not evict the run, nor its readable siblings (#781).
+            if (row.previewServers !== undefined) {
+                if (Array.isArray(row.previewServers))
+                    row.previewServers = row.previewServers.filter((entry) => previewServerSchema.safeParse(entry).success);
+                else
+                    delete row.previewServers;
+            }
+        }
+    return z.array(runRecordSchema).safeParse(raw);
+}
+/** One stored record (a row's `data`) through `parseRunRecords`' salvage and schema, with what the
+ *  schema dropped. Read after the salvage ran: what it removes (an unreadable CI wait, a preview
+ *  server entry) the runtime has decided to drop, and keeps dropping on the next write, as it always
+ *  has; only what the schema does not know is put back. */
+function decodeStoredRecord(raw) {
+    const upgraded = hasLegacyWaitFields(raw);
+    const parsed = parseRunRecords([raw]);
+    if (!parsed.success)
+        return undefined;
+    const run = parsed.data[0];
+    return { run, extras: collectRawExtras(raw, run), ...(upgraded ? { upgraded: true } : {}) };
+}
+/** One database row's `data` back into a record and its extras. Undefined when it does not parse:
+ *  one unreadable row costs that row only. */
+export function decodeRunRow(data) {
+    try {
+        return decodeStoredRecord(JSON.parse(data));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** One database row's `data` back into a record, for a reader that never writes it back. */
+export function decodeRunRecord(data) {
+    try {
+        const parsed = parseRunRecords([JSON.parse(data)]);
+        return parsed.success ? parsed.data[0] : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export { LEGACY_INDEX_BACKUP_FILE, LEGACY_INDEX_FILE } from './legacy-index.js';
+/** The pauses between open attempts while the database is busy, when `open` may wait (a boot):
+ *  about 3.5 s in all, with each attempt's own busy timeout. Long enough for another process to
+ *  finish importing a large `runs.json`. */
+const OPEN_RETRY_DELAYS_MS = [50, 100, 200, 400, 800, 1600];
+/** Block this thread for `ms`. Only `open` does, at boot, when there is nothing else to run. */
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/** Runs (and conversation roots, one family query each) the open-time facts warm-up enumerates
+ *  per event-loop turn (hearsay-tools/cezarion#949), so each slice stays a few milliseconds. */
+const WARM_IDS_PER_SLICE = 100;
+const MAX_RUNS_KEPT = 300;
+/** How many archived root runs the run lists carry per project (#864): `GET /run-summaries?archived=recent`
+ *  and `GET /workspace/runs-index`. Unarchived runs are never cut; older archived runs page in
+ *  through `GET /run-summaries/archived` and the workspace search. */
+export const ARCHIVED_WINDOW = 200;
+/**
+ * Reconcile one record just read off disk with the fact that whichever process wrote it is gone.
+ *
+ * Mutates and returns `run`. Extracted from `RunStore.open` so the read-only index reader
+ * (`./run-index.ts`) answers the SAME question about a `running` row on disk. Two parsers that
+ * disagree here is a visible bug, not an internal one: the cockpit would show a task as running
+ * in the ⌘K index and failed the moment you opened it.
+ *
+ * `keepLive` (#367): leave `queued`/`running`/`waiting` untouched so the caller can recover them
+ * (RunManager.recover re-queues queued runs, resumes interrupted ones). Without it — one-shot CLI
+ * paths that never recover, and the index reader, which has no manager at all — live-looking runs
+ * are marked failed so no ghost stays behind.
+ */
+export function reconcileLoadedRun(run, opts) {
+    settleLoadedStop(run);
+    restoreLoadedUsageLimitHold(run);
+    failLoadedInterruptedRun(run, opts);
+    clearLoadedStaleResume(run);
+    restoreLostReferencedPullRequest(run, referencedPrDeclaration, resolveReferencedRef);
+    restoreOriginatingIssue(run);
+    // Repository scoping follows reconciliation: stores arm a handle asynchronously, while
+    // the read-only index applies its cached handle to these fresh records (#97). This ordering
+    // also scopes any referenced PR restored above without filtering candidate evidence first.
+    return run;
+}
+function clearLoadedStaleResume(run) {
+    // Recovery owns waits; a usage-limit appointment survives while status is waiting.
+    stageLoaded(run);
+}
+/**
+ * Settle an adopted dead owner’s live run without starting work. Untouched runs cancel; started
+ * runs become interrupted. Stop explicitly cancels its target. Mutates run.
+ */
+export function settleOrphanedRun(run, opts = {}) {
+    if (opts.stop && (run.status === 'queued' || run.status === 'running' || run.status === 'waiting'))
+        run.stopping = true;
+    if (run.status === 'queued' && !run.startedAt && run.workflowDef !== undefined &&
+        run.steps.every((step) => step.status === 'pending' && !step.startedAt && !step.sessionId)) {
+        Object.assign(run, applyExit(run, 'cancel'));
+    }
+    return reconcileLoadedRun(run, { keepLive: false });
+}
+/**
+ * Every field `RunStore.open` may rewrite while loading a record: what `reconcileLoadedRun`
+ * assigns. Compared before and after, it tells open() which rows normalization changed, so it
+ * marks those dirty and no others. Edit it together with that function, or a normalized row stays unsaved (the store tests pin each field).
+ */
+function loadNormalizedFields(run) {
+    return JSON.stringify([
+        run.stopping, run.status, run.finishedAt, run.error, run.autoResumeAt,
+        run.referencedPullRequestUrl, run.pullRequests,
+        run.issueNumber, run.referencedIssueUrl, run.referencedIssueNumberSeeded, run.hasPendingPermission, run.steps.map((step) => step.status),
+    ]);
+}
+/** Test seam (#779): `beforeTransaction` runs once `runs.json` is read and parsed, before the
+ *  import asks for the write lock; `beforeCommit` runs inside the import transaction, after every
+ *  row is written and before the last check that no older cezar wrote `runs.json` meanwhile. */
+let legacyImportHook;
+export function __setLegacyImportHookForTests(hook) {
+    legacyImportHook = hook;
+}
+/**
+ * Import legacy rows and the completion marker atomically, once. Recheck live-writer evidence
+ * before commit and preserve exact input bytes in a synced backup. Leave runs.json untouched;
+ * invalid entries are skipped and reported.
+ */
+function importLegacyIndex(db, dataDir) {
+    assertNoLegacyCockpit(dataDir);
+    const snapshot = readLegacyIndex(join(dataDir, LEGACY_INDEX_FILE));
+    const parsed = snapshot ? legacyIndexRows(snapshot.bytes, parseRunRecords) : undefined;
+    const rows = parsed?.rows ?? [];
+    const skipped = parsed?.skipped ?? 0;
+    const source = !snapshot ? 'none' : parsed ? LEGACY_INDEX_FILE : `${LEGACY_INDEX_FILE} (unparseable)`;
+    assertNoLegacyWriter(dataDir, snapshot);
+    legacyImportHook?.beforeTransaction?.();
+    let backup;
+    const commit = db.transaction({
+        upserts: rows,
+        deletes: [],
+        onlyIfMetaAbsent: RUNS_IMPORT_COMPLETE_KEY,
+        beforeCommit: () => {
+            legacyImportHook?.beforeCommit?.();
+            assertNoLegacyWriter(dataDir, snapshot);
+            backup = snapshot ? backUpLegacyIndex(dataDir, snapshot) : undefined;
+            const read = snapshot ? { bytes: snapshot.bytes.length, sha256: snapshot.sha256, backup } : {};
+            return { [RUNS_IMPORT_COMPLETE_KEY]: JSON.stringify({ at: new Date().toISOString(), source, records: rows.length, ...(skipped > 0 ? { skipped } : {}), ...read }) };
+        },
+    });
+    // Told once, by the import that committed: the marker means no later open reads runs.json again.
+    if (commit.skipped || backup === undefined)
+        return;
+    const kept = `Its exact bytes are kept in ${join(dataDir, backup)}; https://github.com/hearsay-tools/cezarion/blob/main/docs/run-history-recovery.md says how to import it after a repair.`;
+    if (!parsed)
+        console.warn(`${logPrefix()} ${LEGACY_INDEX_FILE} could not be read; no run was imported, and this project starts with an empty history. ${kept}`);
+    else if (skipped > 0)
+        console.warn(`${logPrefix()} ${skipped} of ${parsed.total} runs in ${LEGACY_INDEX_FILE} could not be read and were not imported. ${kept}`);
+}
+/**
+ * Finished rows whose stored summary an open-time normalization would still change: a referenced
+ * PR an older cezar's created-PR declaration erased, or issue attribution displaced by a
+ * follow-up declaration (see `reconcileLoadedRun`). Not live, so not
+ * in the `live` column; open decodes these few and keeps the ones it actually repaired.
+ */
+const LEGACY_REFERENCE_HEAL_SQL = "(json_extract(summary, '$.markerRefs.pr') IS NOT NULL AND json_extract(summary, '$.referencedPullRequestUrl') IS NULL)" +
+    " OR (NOT EXISTS (SELECT 1 FROM meta WHERE key = 'issue-attribution:' || runs.id AND value = CAST(runs.revision AS TEXT)) AND json_extract(summary, '$.markerRefs.issue') IS NOT NULL)";
+/**
+ * Rows whose record names the automation that launched it while the stored summary does not
+ * (hearsay-tools/cezarion#1332): summaries a cezar wrote before `RunSummary.automationId`
+ * existed. Open rewrites each one's summary once, so the sidebar's Automations tab classifies a
+ * finished task nobody has opened since the upgrade. `instr` keeps the JSON parse off every
+ * other row.
+ */
+const AUTOMATION_ORIGIN_HEAL_SQL = "instr(data, '\"automation') > 0 AND json_extract(summary, '$.automationId') IS NULL" +
+    " AND (json_extract(data, '$.automation.automationId') IS NOT NULL OR json_extract(data, '$.automationTrigger.automationId') IS NOT NULL)";
+/** A record as a branch owner, or undefined when it owns no branch and created no PR: the
+ *  projection `listBranchOwners` reads off a row's summary and columns, computed from memory. */
+export function branchOwnerOf(run) {
+    const branch = encodeRunRow(run).branch;
+    if (!branch && run.pullRequestUrl === undefined)
+        return undefined;
+    return {
+        id: run.id, title: run.title, status: run.status, archived: run.archived, createdAt: run.createdAt,
+        ...(branch ? { branch } : {}),
+        ...(run.baseBranch === undefined ? {} : { baseBranch: run.baseBranch }),
+        ...(run.pullRequestUrl === undefined ? {} : { pullRequestUrl: run.pullRequestUrl }),
+    };
+}
+/** The one answer every control gives for a run another cezar process owns (`409 { error }`). */
+export const RUN_IN_USE_ELSEWHERE = `run is in use by another ${productName('cezar')} process`;
+/** The answer for a run this process stopped writing after a conflicting write. */
+export const RUN_QUARANTINED = `run changed under this ${productName('cezar')} process — restart ${productName('cezar')} to reload it`;
+/** A write this store must not make: another process owns the run, its owner died with work
+ *  still live (adopt it first), or a conflict quarantined it. Nothing was changed. */
+export class RunWriteRefusedError extends Error {
+    runId;
+    ownership;
+    constructor(runId, ownership, fallbackError) {
+        super(ownership === 'fallback' ? fallbackError ?? `run ${runId} is read only in the fallback project directory`
+            : ownership === 'quarantined' ? `${RUN_QUARANTINED}: ${runId}`
+                : ownership === 'orphaned' ? `run ${runId} belongs to a ${productName('cezar')} process that exited; take it over before writing it`
+                    : `${RUN_IN_USE_ELSEWHERE}: ${runId}`);
+        this.runId = runId;
+        this.ownership = ownership;
+        this.name = 'RunWriteRefusedError';
+    }
+}
+/** Make `target` hold exactly `source`'s fields, keeping the object every holder references. */
+function replaceRecord(target, source) {
+    for (const key of Object.keys(target))
+        if (!(key in source))
+            delete target[key];
+    Object.assign(target, source);
+}
+/**
+ * A worker's destroy moving between two unfinished phases, and nothing else changing: nothing the
+ * family reconcile reads changed, so it may skip that pass (#880). The first request and the
+ * `complete` phase still reconcile: one changes delivery eligibility, the other settles requests.
+ */
+function isDestroyProgress(before, after) {
+    if (before?.role !== 'worker' || after.role !== 'worker' || !before.destroy || !after.destroy)
+        return false;
+    if (before.destroy.phase === 'complete' || after.destroy.phase === 'complete')
+        return false;
+    return isDeepStrictEqual({ ...before, destroy: undefined }, { ...after, destroy: undefined });
+}
+/** NDJSON transcript text to events; a damaged line is skipped, never fatal. */
+function parseEvents(raw) {
+    return raw
+        .split('\n')
+        .filter(Boolean)
+        .map((line) => {
+        try {
+            return JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter((e) => e !== null);
+}
+function newestFirst(a, b) {
+    if (a.createdAt !== b.createdAt)
+        return a.createdAt < b.createdAt ? 1 : -1;
+    return a.seq < b.seq ? -1 : a.seq > b.seq ? 1 : 0;
+}
+/** An archived page's cursor: the last row's order, opaque to clients. A held run with no row yet
+ *  lists after every row (`seq` is infinite), which JSON cannot carry, so it travels as null. */
+function encodeArchivedCursor(key) {
+    return Buffer.from(JSON.stringify({ c: key.createdAt, s: Number.isFinite(key.seq) ? key.seq : null })).toString('base64url');
+}
+function decodeArchivedCursor(cursor) {
+    try {
+        const parsed = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+        if (typeof parsed !== 'object' || parsed === null)
+            return undefined;
+        const { c, s } = parsed;
+        if (typeof c !== 'string' || !(s === null || (typeof s === 'number' && Number.isInteger(s))))
+            return undefined;
+        return { createdAt: c, seq: s ?? Number.POSITIVE_INFINITY };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The items newest first, each by the order beside it. Stable: ties keep their input order. */
+function sortNewestFirst(entries) {
+    return [...entries].sort(([, a], [, b]) => newestFirst(a, b)).map(([item]) => item);
+}
+/** The delegation family a run belongs to, by its root's id: a root is its own, a worker its
+ *  parent's. Workers cannot delegate, so a family is one root and its direct workers, never more. */
+function familyRootOf(run) {
+    if (run.delegation?.role === 'root')
+        return run.id;
+    if (run.delegation?.role === 'worker')
+        return run.delegation.parentRunId;
+    return undefined;
+}
+/** Tests freeze the copies of cold runs, so an in-place write to one throws instead of vanishing. */
+function deepFreeze(value) {
+    if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+        Object.freeze(value);
+        for (const child of Object.values(value))
+            deepFreeze(child);
+    }
+    return value;
+}
+const WORKER_PROCESS_CAP = 32;
+const recordedProcessSchema = z.object({ pid: z.number().int().positive(), startToken: z.string().min(1).max(128).optional(),
+    pgid: z.number().int().positive().optional() }).strict();
+const workerProcessRecordSchema = z.object({ generation: z.string().uuid(), controller: recordedProcessSchema,
+    processes: z.array(recordedProcessSchema).max(WORKER_PROCESS_CAP) }).strict();
+const startToken = (pid) => { const token = processStartToken(pid); return token === undefined ? {} : { startToken: token }; };
+/**
+ * Run rows in runs.db plus append-only NDJSON events and an in-process event bus. Hold live,
+ * pinned, related and unsettled records only. Optimistic writes debounce; durable commits
+ * publish after persistence. Family claims fence every write.
+ */
+export class RunStore extends EventEmitter {
+    dataDir;
+    /** The held set: every record this store keeps in memory, by id. */
+    held = new Map();
+    /** Who holds a run beyond its record, by holder, so one holder's unpin never releases another. */
+    pins = new Map();
+    /** Staged ids while a durable commit installs and announces them: never evicted mid-commit. */
+    committing = new Set();
+    saveTimer = null;
+    /** `null` once the store is closed, and in a `RunStore.unavailable` store (nothing is written,
+     *  nothing is evicted). */
+    db = null;
+    get reports() { return reportsIndex(this.db, this, this.dataDir, this.openFailure); }
+    /** Why `open` failed, in a `RunStore.unavailable` store. */
+    openFailure;
+    persistence;
+    /** Runs whose held record is ahead of its row; the next save or commit writes them. */
+    dirty = new Set();
+    /** The lifecycle events run exits write (B12). */
+    exitEvents = new ExitEvents((id, event) => this.appendEvent(id, event));
+    /** Runs gone from memory whose rows the next save or commit deletes. */
+    deleted = new Set();
+    /** Deleted runs whose history files (events, handoff, images, artifacts) go once the delete of
+     *  their row commits: until then a conflict can undo the delete and bring the row back. */
+    historyOwed = new Set();
+    /** The repository this project IS (#945), armed after `open()` by `setRepoHandle`. Undefined
+     *  until it arrives and `null` when it cannot be known — both mean "unscoped", which is
+     *  exactly the pre-#945 behavior. */
+    repoHandle;
+    /** `open()`'s `keepLive`, which a run read later from `runs.db` is reconciled with too. */
+    keepLive = false;
+    /** This store's identity in `run_claims`; undefined without a database. */
+    owner;
+    /** The families this store claims, with the generation each acquisition got. */
+    claimed = new Map();
+    /** Families judged free whose claim a busy database kept this store from taking: the next write
+     *  of their rows takes it in its own transaction, if it is still as judged (null: absent). */
+    pendingClaims = new Map();
+    /** The revision and `data` of each held row (and pending deletion) as this store last read or
+     *  wrote it: what a write is fenced against, and a conflict's "original". No entry: this store
+     *  created the row and has not written it yet. `extras` is what that `data` holds beyond the
+     *  schema, which the next write of the row puts back (raw-record.ts). */
+    base = new Map();
+    /** Rows read cold in the current synchronous turn, so a commit staged from one is fenced against
+     *  the version it was computed from. `owned`: its family was already this store's when read.
+     *  Cleared at the next microtask: no commit spans a turn. */
+    coldBase = new Map();
+    coldReads = new ColdReadCache();
+    /** The family of each pending deletion, whose claim the deleting write is fenced against. */
+    deletedFamilies = new Map();
+    /** Rows a conflicting write excluded: this store refuses to write them until it is reopened. */
+    quarantined = new Set();
+    /** Rows whose `data` this store tried to decode and could not: left in the database untouched,
+     *  and left out of the list rows from then on, as the cold reader leaves them out (run-index.ts). */
+    unreadable = new Set();
+    /** Background one-at-a-time compressor for archived transcripts (#818). */
+    compressor;
+    /** Transcript facts the delegation paths ask about, so they never re-read a transcript (#880). */
+    facts;
+    liveItems = new LiveItemSnapshots();
+    fallbackFacts;
+    factsFor(id) { return this.isFallbackRun(id) ? this.fallbackFacts ??= new TranscriptFactsIndex(this.sourceDataDir(id), true) : this.facts; }
+    /** Capture both sources on the same synchronous sequence boundary before history IO. */
+    liveReadSnapshot(runId) {
+        return { events: this.liveItems.read(runId), throughSeq: this.seqs.get(runId) ?? Infinity };
+    }
+    constructor(dataDir) {
+        super();
+        this.dataDir = dataDir;
+        this.setMaxListeners(100);
+        this.facts = new TranscriptFactsIndex(dataDir);
+        this.compressor = new HistoryCompressor(dataDir, (id) => this.isHistoryCompressEligible(id), (id, plain, archive) => this.facts.adoptArchive(id, plain, stampOf(archive)));
+    }
+    /**
+     * Open the project's run store. See `reconcileLoadedRun` for what `keepLive` (#367) decides
+     * about live-looking rows.
+     *
+     * Reads `runs.db` once its import is complete. Before that, `runs.json` is imported into it in
+     * one transaction (`importLegacyIndex`) and left exactly as it was, for older cezars to read.
+     * Either way only the held set is decoded: the live rows (by the indexed `live` column), the
+     * few finished rows a normalization still repairs, and the delegation families of the live
+     * ones.
+     *
+     * A store that cannot be opened is never an empty one (#779, plan step 4): `open` throws a
+     * `RunStoreOpenError` naming the cause, and nothing is reset, restored or deleted. `retryBusy`
+     * waits out a busy database (and a cockpit that may still be importing) with growing pauses,
+     * about 3.5 s in all, before it gives up. Open is synchronous, so the wait blocks this thread:
+     * only a boot passes it, while nothing else runs yet. Without it a busy database fails after
+     * one busy timeout.
+     */
+    static open(dataDir, opts) {
+        const path = join(dataDir, RUNS_DB_FILE);
+        const delays = opts?.retryBusy ? OPEN_RETRY_DELAYS_MS : [];
+        const started = Date.now();
+        for (let attempt = 0;; attempt++) {
+            try {
+                return RunStore.openOnce(dataDir, path, opts?.keepLive === true, opts?.maintenance === true, opts?.persist);
+            }
+            catch (error) {
+                const transient = error instanceof RunDatabaseBusyError || (error instanceof LegacyWriterError && error.reason === 'cockpit');
+                if (!transient || attempt >= delays.length) {
+                    throw toRunStoreOpenError(error, path, attempt > 0 ? { waitedMs: Date.now() - started } : {});
+                }
+                sleepSync(delays[attempt]);
+            }
+        }
+    }
+    static openOnce(dataDir, path, keepLive, maintenance, persist) {
+        const source = fallbackRunSource(dataDir, bytes => legacyIndexRows(bytes, parseRunRecords)?.rows);
+        const deferred = source && !existsSync(path) && !existsSync(join(dataDir, LEGACY_INDEX_FILE));
+        if (!deferred)
+            mkdirSync(join(dataDir, 'runs'), { recursive: true });
+        const store = new RunStore(dataDir);
+        store.keepLive = keepLive;
+        store.persistence = persist;
+        let db = RunDatabase.open(deferred ? ':memory:' : path);
+        try {
+            if (deferred)
+                db.transaction({ upserts: [], deletes: [], meta: { [RUNS_IMPORT_COMPLETE_KEY]: 'none' } });
+            else if (db.getMeta(RUNS_IMPORT_COMPLETE_KEY) === undefined)
+                importLegacyIndex(db, dataDir);
+            if (source)
+                db = addRunSource(db, dataDir, source);
+            store.db = db;
+            store.owner = openClaimSession();
+            if (!maintenance) {
+                store.loadHeldRows();
+                store.warmTranscriptFacts();
+                store.exitEvents.writeLoaded();
+            }
+        }
+        catch (error) {
+            if (store.owner) {
+                try {
+                    db.releaseClaims(store.owner.session);
+                }
+                catch { /* the session closes below: its claims are provably dead */ }
+                closeClaimSession(store.owner.session);
+            }
+            store.owner = undefined;
+            store.db = null;
+            store.held.clear();
+            store.dirty.clear();
+            store.claimed.clear();
+            store.base.clear();
+            db.close();
+            throw error;
+        }
+        return store;
+    }
+    /**
+     * The store `serve` keeps for its boot project when `open` failed: no database, nothing held,
+     * and every attempt to create or save a run refused with `failure`. The cockpit answers every
+     * route of that project with `failure`'s message, and boot skips everything that would read
+     * its empty run list as "no runs" (orphan pruning, retention, recovery, scratch sweeps). The
+     * way out is a restart once the cause is gone.
+     */
+    static unavailable(dataDir, failure) {
+        const store = new RunStore(dataDir);
+        store.openFailure = failure;
+        return store;
+    }
+    /** Why this store has no database, when it is `RunStore.unavailable`'s: its runs are unknown,
+     *  not absent. */
+    get unavailable() { return this.openFailure; }
+    /** Every sidecar for a run follows the winning record, never file-by-file fallback. */
+    sourceDataDir(id) { return this.isFallbackRun(id) ? dataReadDirs(this.dataDir)[1] : this.dataDir; }
+    isFallbackRun(id) { return this.db?.isFallback(id) ?? false; }
+    hasFallbackRun(id) { return this.db?.hasFallback(id) ?? false; }
+    fallbackDeleteError(id, kind = 'record') { return fallbackRunDeleteError(this.dataDir, kind === 'record' ? this.hasFallbackRun(id) : this.isFallbackRun(id), this.peek(id)?.worktreePath); }
+    /**
+     * Open-time load: the live rows, the finished rows a load normalization repairs, then the
+     * delegation families of the live ones. A row that does not parse is skipped and left in the
+     * database untouched; one warning says how many.
+     *
+     * Only rows this store can claim are loaded (#779, plan step 3). A live row whose family another
+     * live process claims — `serve`'s parked run, seen by a headless `cez run` — is that process's:
+     * it is not loaded, normalized or recovered here, and stays readable through `getRun` and the
+     * list rows. A live row nobody alive claims is taken over, as before: this open recovers it
+     * (`keepLive`) or settles it as interrupted.
+     */
+    loadHeldRows() {
+        let unreadable = 0;
+        const decode = (row) => {
+            const decoded = decodeRunRow(row.data);
+            if (!decoded) {
+                unreadable++;
+                this.unreadable.add(row.id);
+            }
+            return decoded;
+        };
+        const live = this.db.listLive();
+        const owned = this.claimFamilies(live.map(rowFamily), { allowLive: true, wait: true });
+        for (const row of live) {
+            if (!owned.has(rowFamily(row)))
+                continue;
+            const decoded = decode(row);
+            if (decoded)
+                this.adoptLoadedRun(decoded, { keepLive: this.keepLive }, row);
+        }
+        const heal = this.db.listWhere(LEGACY_REFERENCE_HEAL_SQL).filter((row) => !this.held.has(row.id));
+        const healable = this.claimFamilies(heal.map(rowFamily));
+        for (const row of heal) {
+            if (!healable.has(rowFamily(row)))
+                continue;
+            const decoded = decode(row);
+            // Held only when the repair changed it: the next save writes it, then it leaves.
+            if (decoded) {
+                // Persist verification once even when legacy issue attribution was already correct.
+                const needsIssueCheck = decoded.run.markerRefs?.issue !== undefined &&
+                    this.db.getMeta(`issue-attribution:${row.id}`) !== String(row.revision);
+                this.adoptLoadedRun(decoded, { keepLive: this.keepLive, onlyIfChanged: !needsIssueCheck }, row);
+                if (needsIssueCheck)
+                    this.dirty.add(row.id);
+            }
+        }
+        const stale = this.db.listWhere(AUTOMATION_ORIGIN_HEAL_SQL).filter((row) => !this.held.has(row.id));
+        const restamp = this.claimFamilies(stale.map(rowFamily));
+        for (const row of stale) {
+            if (!restamp.has(rowFamily(row)))
+                continue;
+            const decoded = decode(row);
+            // Nothing in the record changes, only its summary: held dirty, the next save rewrites it.
+            if (decoded) {
+                this.adoptLoadedRun(decoded, { keepLive: this.keepLive }, row);
+                this.dirty.add(row.id);
+            }
+        }
+        for (const rootId of this.anchoredFamilies())
+            this.holdFamily(rootId, decode);
+        this.releaseUnheldClaims();
+        if (unreadable > 0)
+            console.warn(`${logPrefix()} ${unreadable} run(s) in ${RUNS_DB_FILE} could not be read; they are left in the database untouched.`);
+    }
+    /** Normalize a record just read from `row` (see `reconcileLoadedRun`) and hold it. Marks the row
+     *  dirty only when normalization changed it, so the next save persists exactly the runs open()
+     *  rewrote. A row read up from schema-3 wait fields counts as changed: its rewrite drops them
+     *  and recomputes its summary and live column (`upgradeLegacyWaits`). The caller has claimed
+     *  the row's family. */
+    adoptLoadedRun({ run, extras, upgraded }, opts, row) {
+        if (this.db?.familyHasFallback(rowFamily(row)))
+            return;
+        const before = loadNormalizedFields(run);
+        const wasCancelled = run.status === 'cancelled';
+        if (opts.settle)
+            settleOrphanedRun(run, { stop: opts.stop });
+        else
+            reconcileLoadedRun(run, opts);
+        const changed = upgraded === true || loadNormalizedFields(run) !== before;
+        if (opts.onlyIfChanged && !changed)
+            return;
+        this.held.set(run.id, run);
+        this.base.set(run.id, { revision: row.revision, seq: row.seq, data: row.data, extras });
+        if (changed)
+            this.dirty.add(run.id);
+        if (!wasCancelled && run.status === 'cancelled')
+            this.exitEvents.loadCancelled(run.id);
+    }
+    /**
+     * Hold one delegation family: its root and the root's direct workers, read through the
+     * `parent_run_id` index. No recursion: workers cannot delegate, so a worker's own id never
+     * names a family. The caller has claimed it. `settle` settles its live rows instead of keeping
+     * them for recovery (`settleOrphanedRun`); `stopId` is the run a Stop settles as cancelled.
+     */
+    holdFamily(rootId, decode = (row) => decodeRunRow(row.data), settle = false, stopId) {
+        const rows = [this.db.get(rootId), ...this.db.listByParent(rootId)];
+        for (const row of rows) {
+            if (!row || this.held.has(row.id) || this.deleted.has(row.id))
+                continue;
+            const decoded = decode(row);
+            if (decoded)
+                this.adoptLoadedRun(decoded, { keepLive: this.keepLive, settle, stop: row.id === stopId }, row);
+        }
+    }
+    /** Make sure this store claims each of `families`; `claimStoreFamilies` takes the free ones. */
+    claimFamilies(families, opts = {}) {
+        return projectWriteRefused(this.dataDir) ? new Set() : claimStoreFamilies({
+            claimed: this.claimed,
+            pendingClaims: this.pendingClaims,
+            db: this.db,
+            owner: this.owner,
+            scheduleSave: () => this.scheduleSave(),
+        }, families, opts);
+    }
+    /** Release the claim of every family with nothing left in memory, once nothing is pending: a
+     *  failed save keeps its families claimed until it succeeds. A failed release retries at the
+     *  next sweep; `close()` releases the rest. */
+    releaseUnheldClaims() {
+        if (!this.db || !this.owner || this.dirty.size > 0 || this.deleted.size > 0)
+            return;
+        const kept = new Set();
+        for (const run of this.held.values())
+            kept.add(familyKey(run));
+        // A claim never taken has nothing to release in the database.
+        for (const family of this.pendingClaims.keys())
+            if (!kept.has(family))
+                this.pendingClaims.delete(family);
+        const released = [...this.claimed.keys()].filter((family) => !kept.has(family));
+        if (released.length === 0)
+            return;
+        try {
+            this.db.releaseClaims(this.owner.session, released);
+            for (const family of released)
+                this.claimed.delete(family);
+        }
+        catch {
+            // Busy or failing: the next sweep tries again.
+        }
+    }
+    /**
+     * Who may change this run right now (see `RunOwnership`), or undefined when there is no such
+     * run. Read-only: nothing is claimed. Controls ask this first, so a run another process owns is
+     * refused with `RUN_IN_USE_ELSEWHERE` and a dead process's run is adopted before it is changed.
+     */
+    runOwnership(id) {
+        if (this.quarantined.has(id))
+            return 'quarantined';
+        const held = this.held.get(id);
+        if (!this.db)
+            return held ? 'held' : undefined;
+        const family = held ? familyKey(held) : this.deleted.has(id) ? undefined : this.db.familyOf(id);
+        if (family === undefined)
+            return undefined;
+        if (this.db.familyHasFallback(family))
+            return 'fallback';
+        if (this.claimed.has(family) || this.pendingClaims.has(family))
+            return 'held';
+        const claim = this.db.getClaim(family);
+        if (claim && claimOwnerLive(claim))
+            return 'foreign';
+        // The same rule `claimFamilies` writes by: a dead owner left only settled runs → free.
+        return this.db.familyHasLive(family) ? 'orphaned' : 'free';
+    }
+    /** Why a control on this run must be refused here, or undefined when this store may change it. */
+    writeRefusal(id) {
+        const ownership = this.runOwnership(id);
+        if (ownership === 'quarantined')
+            return RUN_QUARANTINED;
+        if (ownership === 'fallback')
+            return this.fallbackRefusal(id).message;
+        return ownership === 'foreign' || ownership === 'orphaned' ? RUN_IN_USE_ELSEWHERE : undefined;
+    }
+    /**
+     * Claim an orphaned family before a control, then settle its live rows.
+     * Stop cancels its target. Return the root id, or undefined for a live owner or missing run.
+     */
+    adoptFamily(id, opts = {}) {
+        const family = this.db?.familyOf(id);
+        if (family === undefined || !this.claimFamilies([family], { allowLive: true, wait: true }).has(family))
+            return undefined;
+        this.holdFamily(family, undefined, true, opts.stop ? id : undefined);
+        this.exitEvents.writeLoaded();
+        return family;
+    }
+    /** Explicit controls only (`requireRunControl`): copy a fallback family in so it can be written. */
+    adoptFallbackFamily(id) {
+        const members = copyFallbackFamily(this.db, id, this.owner);
+        for (const member of members)
+            this.coldReads.forget(member);
+        return members.length > 0;
+    }
+    fallbackRefusal(id) { return new RunWriteRefusedError(id, 'fallback', fallbackRunDeleteError(this.dataDir, true)); }
+    /** Run files are written only for a family this store may write, never a fallback family. */
+    writeDir(id) { if (this.runOwnership(id) === 'fallback')
+        throw this.fallbackRefusal(id); return this.dataDir; }
+    /** Every run whose family another process owns (`foreignClaimedRunIds`). */
+    listForeignClaimedRunIds() { return foreignClaimedRunIds(this.db, this.owner); }
+    /** Non-terminal rows in the database (both directories) and the runs of families another live store claims. */
+    persistedLiveRunIds() { return { live: this.db?.listLive().map((row) => row.id) ?? [], foreign: liveForeignClaimedRunIds(this.db, this.owner) }; }
+    /**
+     * Whether a held run anchors itself (and its family) in memory. Anything else held is a family
+     * member or a settled write, and leaves at the next sweep (`evictSettled`).
+     *
+     * The held set is: every run that is live (`isLiveRecord`), pinned by a RunManager (`pin`),
+     * dirty, or inside a durable commit; plus the whole delegation family (root and direct
+     * workers) of any such run. Families are held because the RunManager reads a live run's family
+     * on every run event — `GET /runs/:id/relationships`, the global `reconcileWorkerWaits` pass
+     * (about twenty call sites), completion blockers and conversations — and decoding a cold
+     * record costs about 200 µs (JSON.parse plus the schema). Measured on a copy of a real
+     * cockpit's `runs.json` (958 runs, 957 of them delegated): a running root with 26 workers
+     * paid about 5 ms per family read, and the live families together about 10 ms per global
+     * pass, all on the event loop. Holding them costs memory in proportion to active work, not to
+     * history.
+     */
+    isAnchor(id, run) {
+        return isLiveRecord(run) || this.pins.has(id) || this.dirty.has(id) || this.committing.has(id);
+    }
+    /** The family roots with an anchoring member in memory. */
+    anchoredFamilies() {
+        const roots = new Set();
+        for (const [id, run] of this.held) {
+            const root = familyRootOf(run);
+            if (root !== undefined && this.isAnchor(id, run))
+                roots.add(root);
+        }
+        return roots;
+    }
+    /** Drop every held run that is neither an anchor nor in an anchored family. A store without a
+     *  database keeps everything: memory is the only copy it has. */
+    evictSettled() {
+        if (!this.db)
+            return;
+        const families = this.anchoredFamilies();
+        for (const [id, run] of this.held) {
+            if (this.isAnchor(id, run))
+                continue;
+            const root = familyRootOf(run);
+            if (root !== undefined && families.has(root))
+                continue;
+            this.held.delete(id);
+            this.base.delete(id);
+            this.coldReads.forget(id);
+        }
+        this.releaseUnheldClaims();
+    }
+    /** A run read from `runs.db`, normalized like a loaded one (`reconcileLoadedRun`, then the
+     *  repository scope) but held by nobody. Undefined when absent, deleted or unreadable. */
+    loadCold(id) {
+        if (!this.db || this.deleted.has(id))
+            return undefined;
+        const row = this.db.get(id);
+        return row ? this.decodeCold(row) : undefined;
+    }
+    decodeCold(row) {
+        this.coldReads.at(row.id, row.revision); // the fence below moves to this revision
+        const decoded = decodeRunRow(row.data);
+        if (!decoded) {
+            this.unreadable.add(row.id);
+            return undefined;
+        }
+        this.unreadable.delete(row.id);
+        const { run, extras } = decoded;
+        if (this.coldBase.size === 0)
+            queueMicrotask(() => this.coldBase.clear());
+        const family = rowFamily(row);
+        this.coldBase.set(row.id, { revision: row.revision, seq: row.seq, data: row.data, extras, owned: this.claimed.has(family) || this.pendingClaims.has(family) });
+        reconcileLoadedRun(run, { keepLive: this.keepLive });
+        rescopeRun(run, this.repoHandle);
+        return run;
+    }
+    /** Hold a writable row. A fallback family's reads stay detached (the cold-read contract). */
+    holdDecoded(run) {
+        if (this.db?.familyHasFallback(familyKey(run)))
+            return process.env.VITEST ? deepFreeze(run) : run;
+        const read = this.coldBase.get(run.id);
+        this.held.set(run.id, run);
+        if (read)
+            this.base.set(run.id, storedRow(read));
+        return run;
+    }
+    /**
+     * Hold a claimed run for a write; leave after settlement unless anchored.
+     * Take the family claim before reading its row. Return undefined for a live foreign owner
+     * or a fallback family: neither claim is granted.
+     */
+    hold(id) {
+        const held = this.held.get(id);
+        if (held)
+            return held;
+        const family = this.db && !this.deleted.has(id) ? this.db.familyOf(id) : undefined;
+        if (family === undefined || !this.claimFamilies([family]).has(family))
+            return undefined;
+        const run = this.coldReads.claimed(id, this.coldBase.get(id), () => this.db?.revisionOf(id)) ?? this.loadCold(id);
+        if (!run)
+            return undefined;
+        this.holdDecoded(run);
+        this.scheduleSave();
+        return run;
+    }
+    /** The record a store write changes in place: held, or loaded to be. Undefined for a run this
+     *  store may not write (another process's, or quarantined), so the write changes nothing. */
+    record(id) {
+        if (this.quarantined.has(id))
+            return undefined;
+        return this.held.get(id) ?? this.hold(id);
+    }
+    /** Read held legacy family members, or a detached cold record. */
+    peek(id) {
+        const held = this.held.get(id);
+        if (held)
+            return held;
+        const run = this.loadCold(id);
+        return run && this.answerCold(run, false);
+    }
+    /**
+     * A run just read off its row, as reads answer it: held when its family is in memory (a live
+     * family's members are read on every run event), else a copy nobody holds — frozen under
+     * vitest when it leaves the store (`freeze`).
+     */
+    answerCold(run, freeze) {
+        const root = familyRootOf(run);
+        if (root !== undefined && this.anchoredFamilies().has(root))
+            return this.holdDecoded(run);
+        return freeze && process.env.VITEST ? deepFreeze(run) : run;
+    }
+    /** `getRun` for a row a query already read: the held object, else decoded from `row`. */
+    fromRow(row) {
+        const held = this.held.get(row.id);
+        if (held)
+            return held;
+        if (this.deleted.has(row.id))
+            return undefined;
+        const cached = this.coldReads.at(row.id, row.revision);
+        if (cached)
+            return cached;
+        const run = this.decodeCold(row);
+        return run && this.coldReads.keep(this.answerCold(run, true), this.coldBase.get(row.id), this.held.has(row.id));
+    }
+    /** Run `fn` reading each run that is not held at most once (`ColdReadCache`, hearsay-tools/cezarion#2378). */
+    withReadCache(fn) { return this.coldReads.scope(fn); }
+    /** Whether the run exists, held or not, without decoding it. */
+    hasRun(id) {
+        return this.held.has(id) || (!!this.db && !this.deleted.has(id) && this.db.has(id));
+    }
+    /**
+     * Keep a run in memory for `holder` until `unpin(id, holder)`: a RunManager pins the runs it is
+     * executing (`active`) and the run a Continue is admitting (`continue`). A finished run is
+     * loaded. Pins are per holder, so releasing one never releases another. Returns the held record.
+     */
+    pin(id, holder) {
+        const run = this.record(id);
+        if (!run)
+            return undefined;
+        let holders = this.pins.get(id);
+        if (!holders)
+            this.pins.set(id, holders = new Set());
+        holders.add(holder);
+        return run;
+    }
+    /** Publish a run's current record again without a write: something read beside the record
+     *  changed, such as the run leaving the manager's live registries, which a detail's finish
+     *  verdict reads (hearsay-tools/cezarion#1301). */
+    republish(id) {
+        const run = this.peek(id);
+        if (run)
+            this.emit('run', run, 'live-release');
+    }
+    /** Release `holder`'s pin. The run leaves memory at the next sweep once nothing else holds it. */
+    unpin(id, holder) {
+        const holders = this.pins.get(id);
+        if (!holders?.delete(holder))
+            return;
+        if (holders.size === 0)
+            this.pins.delete(id);
+        this.sweepIfSettled([id]);
+    }
+    /**
+     * Set discovered repository identity without blocking boot. Recompute conclusions from retained
+     * evidence, including cold records; null retains unknown-handle behavior.
+     */
+    setRepoHandle(handle) {
+        this.repoHandle = handle;
+        if (!handle)
+            return; // nothing to prove foreign against
+        // `touch` per healed run: the cockpit is already live when the handle lands, so a corrected
+        // chip has to reach the open page over SSE, not just the next `runs.json` write.
+        let healed = false;
+        const own = `${handle.owner}/${handle.name}`.toLowerCase();
+        const foreign = (url) => url !== undefined && refUrlRepo(url) !== own;
+        const stored = this.db?.listWhere(REFERENCED_RUN_RULE.sql).filter((row) => {
+            if (this.held.has(row.id) || this.deleted.has(row.id))
+                return false;
+            const summary = parseStoredSummary(row.summary);
+            return !summary || foreign(summary.referencedPullRequestUrl) || foreign(summary.referencedIssueUrl);
+        }) ?? [];
+        for (const run of [...this.held.values()]) {
+            if (rescopeRun(run, this.repoHandle)) {
+                this.touch(run);
+                healed = true;
+            }
+        }
+        // Only rows this store may write: another process's runs heal when their owner arms its handle.
+        const writable = this.claimFamilies(stored.map(rowFamily));
+        for (const row of stored) {
+            if (!writable.has(rowFamily(row)))
+                continue;
+            const run = this.decodeCold(row);
+            // `decodeCold` already scoped it with the handle just armed; write it when that changed it.
+            if (!run || !this.storedScopeDiffers(row, run))
+                continue;
+            this.holdDecoded(run);
+            this.touch(run);
+            healed = true;
+        }
+        // Discovery may finish after headless shutdown's final flush. Persist repairs now: the
+        // debounced save is unref'd, so it cannot keep the CLI alive once the lookup completes.
+        if (healed)
+            this.flush();
+    }
+    /** Whether the stored summary still names a reference the scoped record no longer has. */
+    storedScopeDiffers(row, run) {
+        const summary = parseStoredSummary(row.summary);
+        return summary?.referencedPullRequestUrl !== run.referencedPullRequestUrl ||
+            summary?.referencedIssueUrl !== run.referencedIssueUrl || summary?.issueNumber !== run.issueNumber;
+    }
+    /**
+     * The live set, newest first: runs whose record is live (`isLiveRecord`) or that a RunManager
+     * pins. Finished runs are not here — read one by id (`getRun`), by an indexed query
+     * (`listWorkersOf`, `findRunByClientRequestId`, `listRunsWithWorktree`,
+     * `listBranchOwners`), or as list rows (`listRunSummaries`).
+     */
+    listRuns() {
+        return sortNewestFirst([...this.held].filter(([id, run]) => isLiveRecord(run) || this.pins.has(id)).map(([, run]) => [run, this.listOrder(run)]));
+    }
+    /** Where a held run lists: its row's insertion order, or after every row while this store has
+     *  not written it yet. The held set keeps such runs in creation order, and so does every list
+     *  that sorts them in held-set order (`sortNewestFirst` is stable). */
+    listOrder(run) {
+        return { createdAt: run.createdAt, seq: this.base.get(run.id)?.seq ?? Number.POSITIVE_INFINITY };
+    }
+    /**
+     * EVERY run as a full record, newest first — decoded row by row. Only the legacy `GET /runs`
+     * (older clients; the cockpit reads `GET /run-summaries`) may call this: it is exactly the
+     * whole-history parse #779 exists to remove from everything else.
+     */
+    listAllRunsForLegacyRoute() {
+        const runs = new Map();
+        for (const row of this.db?.listAll() ?? []) {
+            if (this.deleted.has(row.id) || this.held.has(row.id))
+                continue;
+            const run = this.decodeCold(row);
+            if (run)
+                runs.set(row.id, [run, row]);
+        }
+        for (const [id, run] of this.held)
+            runs.set(id, [run, this.listOrder(run)]);
+        return sortNewestFirst(runs.values());
+    }
+    /** A bounded page of discoverable peer roots, including the current held overlay. */
+    listPeerTaskSummaries(options) {
+        return listPeerTaskSummaries({ db: this.db, held: this.held, skipped: this.deleted,
+            order: run => this.listOrder(run), cold: id => this.coldSummary(id) }, options);
+    }
+    /**
+     * Every run as its list row, newest first: the stored `summary` column, with each held run's
+     * own projection laid over it — a debounced save keeps memory up to 300 ms ahead of the row,
+     * and a run created since the last save has no row yet. `usage` is the caller's to attach.
+     *
+     * With `archivedWindow` (#864), the window the cockpit's lists read: every unarchived run, plus
+     * the newest `archivedWindow` archived ROOT runs, and whether older archived roots were left
+     * out. Archived workers are never in it (see `RunDatabase.listWindowSummaries`); with `roots`,
+     * no worker is — the runs index, whose readers list no workers. A held run
+     * lists by its record, so one archived or unarchived since the last save is ranked as it is now.
+     *
+     * A row this store found unreadable is left out, as the cold reader leaves out a row it had to
+     * decode and could not. A finished row nobody has decoded is served from its summary by both,
+     * which decodes nothing; reading it is what finds out (`isUnreadable`).
+     */
+    listRunSummaries(options = {}) {
+        const { archivedWindow, roots = false } = options;
+        // Every skipped row may be an archived root, so ask for that many more: one past the window
+        // after skipping is how "older ones were left out" is known without counting them.
+        const rows = (archivedWindow === undefined
+            ? this.db?.listSummaries()
+            : this.db?.listWindowSummaries(archivedWindow + 1 + this.deleted.size + this.unreadable.size + this.held.size, { roots })) ?? [];
+        const summaries = new Map();
+        for (const row of rows) {
+            if (this.deleted.has(row.id) || this.held.has(row.id) || this.unreadable.has(row.id))
+                continue;
+            const summary = parseStoredSummary(row.summary) ?? this.coldSummary(row.id);
+            if (summary)
+                summaries.set(row.id, [summary, row]);
+        }
+        for (const [id, run] of this.held) {
+            if (archivedWindow !== undefined && (run.archived || roots) && run.delegation?.role === 'worker')
+                continue;
+            summaries.set(id, [toRunSummary(run), this.listOrder(run)]);
+        }
+        const runs = sortNewestFirst(summaries.values());
+        if (archivedWindow === undefined)
+            return { runs, truncated: false };
+        let archived = 0;
+        const kept = runs.filter((run) => !run.archived || ++archived <= archivedWindow);
+        return { runs: kept, truncated: archived > archivedWindow };
+    }
+    /**
+     * One page of archived ROOT runs, newest first (#864): `GET /run-summaries/archived`, the
+     * archived runs past the window. Held runs list by their record, as in `listRunSummaries`.
+     * `before` is the previous page's `nextCursor`; with `q`, only runs `matchesRunQuery` keeps, and
+     * `total` counts those. `automationNames` lets `q` match a task by its automation's name, as the
+     * list's origin line shows it (hearsay-tools/cezarion#1616). A cursor this store did not write
+     * answers `{ error }`.
+     *
+     * Ranking reads every archived root's key (id, created_at, seq: no record, no summary), so the
+     * page and `total` agree with the held overlay; only the page's own rows are read in full.
+     */
+    listArchivedRuns(options) {
+        let after;
+        if (options.before !== undefined) {
+            after = decodeArchivedCursor(options.before);
+            if (!after)
+                return { error: 'before is not a cursor this server wrote' };
+        }
+        const q = options.q?.trim() ?? '';
+        const ranked = this.rankArchivedRows(q, options.automationNames);
+        this.overlayHeldArchived(ranked, q, options.automationNames);
+        const ordered = [...ranked.entries()].sort(([, a], [, b]) => newestFirst(a, b));
+        return this.archivedPage(ordered, after, options.limit);
+    }
+    /** The archived roots in `runs.db`, each by its key: every one without `q` (no record, no
+     *  summary read), and with `q` the searched rows `matchesRunSearch` keeps, which carry the summary
+     *  the search read. A deleted, held or unreadable run's row is left out; a held run joins in
+     *  `overlayHeldArchived`. */
+    rankArchivedRows(q, automationNames) {
+        const skipped = (id) => this.deleted.has(id) || this.held.has(id) || this.unreadable.has(id);
+        const ranked = new Map();
+        if (q === '') {
+            for (const key of this.db?.listKeysWhere(ARCHIVED_ROOT) ?? [])
+                if (!skipped(key.id))
+                    ranked.set(key.id, key);
+        }
+        else {
+            for (const row of this.db?.searchRootSummaries(sqlPrefilterTokens(q, { automationNames })) ?? []) {
+                if (skipped(row.id))
+                    continue;
+                const summary = parseStoredSummary(row.summary) ?? this.coldSummary(row.id);
+                if (summary?.archived && matchesRunSearch(summary, q, { automationNames }))
+                    ranked.set(row.id, { ...row, summary });
+            }
+        }
+        return ranked;
+    }
+    /** Lay the held archived roots over `ranked`, each by its record: it replaces its stored row
+     *  (already left out of `ranked`), and with `q` it must match. A held worker never lists. */
+    overlayHeldArchived(ranked, q, automationNames) {
+        for (const [id, run] of this.held) {
+            if (!run.archived || run.delegation?.role === 'worker')
+                continue;
+            const summary = toRunSummary(run);
+            if (q === '' || matchesRunSearch(summary, q, { automationNames }))
+                ranked.set(id, { ...this.listOrder(run), summary });
+        }
+    }
+    /** The page of `ordered` after the cursor `after`: its summaries, the cursor of the next page,
+     *  and `total`, the count of all of `ordered`. */
+    archivedPage(ordered, after, limit) {
+        const rest = after ? ordered.filter(([, key]) => newestFirst(key, after) > 0) : ordered;
+        const page = rest.slice(0, limit);
+        const runs = this.hydrateArchivedPage(page);
+        const last = page.at(-1)?.[1];
+        return {
+            runs,
+            nextCursor: last && rest.length > page.length ? encodeArchivedCursor(last) : null,
+            total: ordered.length,
+        };
+    }
+    /** The page's summaries: a ranked key's own, else its stored one, read for the rows that have
+     *  none in a single query. A row whose stored summary does not fit the contract is projected from
+     *  its record; a row that cannot be read at all is left out. */
+    hydrateArchivedPage(page) {
+        const cold = new Map((this.db?.getSummaries(page.filter(([, key]) => !key.summary).map(([id]) => id)) ?? [])
+            .map((row) => [row.id, parseStoredSummary(row.summary) ?? this.coldSummary(row.id)]));
+        return page.flatMap(([id, key]) => {
+            const summary = key.summary ?? cold.get(id);
+            return summary ? [summary] : [];
+        });
+    }
+    /**
+     * The ROOT runs, archived or not, that match `query` (`matchesRunSearch`), newest first: at most
+     * `limit`, and whether more matched. The owned half of the workspace search (#864); held runs
+     * match by their record.
+     */
+    searchRunSummaries(query, limit) {
+        const matched = new Map();
+        // Rows come newest first, so the newest `limit + 1` row matches are all a page can use; held
+        // runs, which may be newer than any row, are ranked in below.
+        this.db?.visitRootSummaries(sqlPrefilterTokens(query), (row) => {
+            if (this.deleted.has(row.id) || this.held.has(row.id) || this.unreadable.has(row.id))
+                return true;
+            const summary = parseStoredSummary(row.summary) ?? this.coldSummary(row.id);
+            if (summary && matchesRunSearch(summary, query))
+                matched.set(row.id, [summary, row]);
+            return matched.size <= limit;
+        });
+        for (const [id, run] of this.held) {
+            if (run.delegation?.role === 'worker')
+                continue;
+            const summary = toRunSummary(run);
+            if (matchesRunSearch(summary, query))
+                matched.set(id, [summary, this.listOrder(run)]);
+        }
+        const runs = sortNewestFirst(matched.values());
+        return { runs: runs.slice(0, limit), truncated: runs.length > limit };
+    }
+    /** A row whose stored summary does not fit the contract any more, projected from its record. */
+    coldSummary(id) {
+        const run = this.loadCold(id);
+        return run ? toRunSummary(run) : undefined;
+    }
+    /**
+     * The run, or undefined. A held run is the held object (writes install into it). Any other run
+     * is a fresh copy of its row each call, normalized like a loaded record — frozen under vitest —
+     * so changing it means a store method, never an assignment.
+     */
+    getRun(id) {
+        const held = this.held.get(id);
+        if (held)
+            return held;
+        const cached = this.deleted.has(id) || !this.db ? undefined : this.coldReads.at(id, this.db.revisionOf(id));
+        if (cached)
+            return cached;
+        const run = this.loadCold(id);
+        return run && this.coldReads.keep(this.answerCold(run, true), this.coldBase.get(id), this.held.has(id));
+    }
+    /** Whether the run's row is in `runs.db` but its record could not be read here: what tells a
+     *  run that cannot open from one that does not exist. Known once something tried to read it. */
+    isUnreadable(id) {
+        return this.unreadable.has(id) && !this.held.has(id) && !this.deleted.has(id);
+    }
+    /** The ids in memory right now: the held set, for diagnostics and the benchmark's heap pass. */
+    heldIds() {
+        return [...this.held.keys()];
+    }
+    /**
+     * The workers a root run owns, newest first, read off its own `receipts` (#659). Every
+     * `createOwnedRun` writes the receipt and the worker record in one transaction, and the
+     * receipt list is capped at 1,024 creations (#816), so this is a bounded lookup rather than a walk of the whole
+     * project index. An ordinary or worker run owns nothing and costs one map read; a receipt
+     * whose record has been deleted is skipped, never invented. A parent quarantined to
+     * `invalid` has no readable receipts and reports none, which is also what the cockpit
+     * assumes for that role.
+     */
+    listOwnedWorkers(parentId) {
+        const parent = this.getRun(parentId);
+        if (parent?.delegation?.role !== 'root')
+            return [];
+        const workers = [];
+        for (const receipt of parent.delegation.receipts) {
+            const worker = this.getRun(receipt.workerId);
+            if (worker?.delegation?.role === 'worker' && worker.delegation.parentRunId === parentId)
+                workers.push(worker);
+        }
+        return workers.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+    }
+    /** Every worker filed under `parentId` (the `parent_run_id` index plus memory), newest first:
+     *  receipts or not, which is what the reconcile and deletion checks ask. */
+    listWorkersOf(parentId) {
+        const workers = new Map();
+        for (const run of this.held.values()) {
+            if (run.delegation?.role === 'worker' && run.delegation.parentRunId === parentId)
+                workers.set(run.id, [run, this.listOrder(run)]);
+        }
+        // Ids first: a live family's workers are usually all held, and then no record is read at all.
+        const cold = (this.db?.listIdsByParent(parentId) ?? []).filter((id) => !this.held.has(id) && !this.deleted.has(id));
+        for (const row of cold.length > 0 ? this.db.getMany(cold) : []) {
+            const run = this.fromRow(row);
+            if (run?.delegation?.role === 'worker' && run.delegation.parentRunId === parentId)
+                workers.set(row.id, [run, row]);
+        }
+        return sortNewestFirst(workers.values());
+    }
+    /** The id of every worker, held or stored, without decoding any (recovery's worker passes). */
+    listWorkerIds() {
+        const ids = new Set(this.db?.listWorkerIds() ?? []);
+        for (const id of this.deleted)
+            ids.delete(id);
+        for (const run of this.held.values())
+            if (run.delegation?.role === 'worker')
+                ids.add(run.id);
+        return [...ids];
+    }
+    /** The id of every run whose delegation is quarantined (`invalid`), held or stored: its stored
+     *  summary says so, so nothing is decoded (scratch cleanup). */
+    listQuarantinedRunIds() {
+        const ids = new Set((this.db?.listKeysWhere("json_extract(summary, '$.delegation.role') = 'invalid'") ?? []).map((key) => key.id));
+        for (const id of this.deleted)
+            ids.delete(id);
+        for (const [id, run] of this.held) {
+            if (run.delegation?.role === 'invalid')
+                ids.add(id);
+            else
+                ids.delete(id);
+        }
+        return [...ids];
+    }
+    /** All retained tasks this automation started, including variants, finished and archived runs.
+     * Logs and receipts may compact independently. Read only matching keys in SQLite and overlay
+     * held records so a debounced provenance update or deletion is reflected immediately. */
+    countAutomationRuns(automationId) {
+        const where = "json_extract(data, '$.automation.automationId') = ? OR " +
+            "json_extract(data, '$.automationTrigger.automationId') = ?";
+        const ids = new Set((this.db?.listKeysWhere(where, [automationId, automationId]) ?? [])
+            .map((key) => key.id));
+        for (const id of this.deleted)
+            ids.delete(id);
+        for (const [id, run] of this.held) {
+            if (run.automation?.automationId === automationId || run.automationTrigger?.automationId === automationId)
+                ids.add(id);
+            else
+                ids.delete(id);
+        }
+        return ids.size;
+    }
+    /** First non-archived task referencing a project issue, including secondary references. */
+    findNonArchivedRunByIssue(repo, number) {
+        const url = `https://github.com/${repo}/issues/${number}`.toLowerCase();
+        const matches = (run) => {
+            if (run.archived)
+                return false;
+            const urls = [run.referencedIssueUrl, ...(run.referencedIssueCandidates ?? []),
+                ...(run.automation?.event.startsWith('issue.') ? [run.automation.githubUrl] : []),
+                ...[...run.task.matchAll(new RegExp(ISSUE_URL_RE.source, 'gi'))].map((match) => match[0])]
+                .filter((value) => value !== undefined)
+                .map((value) => value.replace(/\/+$/, '').toLowerCase())
+                .filter((value) => value.endsWith(`/issues/${number}`));
+            // The legacy issueNumber is display-only and cannot establish repository identity.
+            // Explicit task markers remain project-scoped unless a qualified URL contradicts them.
+            return urls.includes(url) || (urls.length === 0 && run.markerRefs?.issue === number);
+        };
+        for (const run of this.held.values())
+            if (matches(run))
+                return run.id;
+        // Secondary references are record-only: query them in SQLite rather than hydrating every
+        // finished transcript or relying on the slim summary's primary issue number.
+        const where = `archived = 0 AND (
+      json_extract(data, '$.issueNumber') = ? OR json_extract(data, '$.markerRefs.issue') = ?
+      OR lower(rtrim(json_extract(data, '$.referencedIssueUrl'), '/')) = ?
+      OR EXISTS (SELECT 1 FROM json_each(data, '$.referencedIssueCandidates') WHERE lower(rtrim(value, '/')) = ?)
+      OR (json_extract(data, '$.automation.event') LIKE 'issue.%' AND lower(rtrim(json_extract(data, '$.automation.githubUrl'), '/')) = ?)
+      OR instr(lower(json_extract(data, '$.task')), ?) > 0
+    )`;
+        for (const key of this.db?.listKeysWhere(where, [number, number, url, url, url, url]) ?? []) {
+            if (this.held.has(key.id) || this.deleted.has(key.id) || this.unreadable.has(key.id))
+                continue;
+            const run = this.getRun(key.id);
+            if (run && matches(run))
+                return key.id;
+        }
+        return undefined;
+    }
+    /**
+     * The runs automation receipts launched, by receipt id (`automation.receiptId` or
+     * `automationTrigger.receiptId`). Memory answers first; a receipt it does not know costs one
+     * pass over `runs.db` that reads the records' JSON in SQLite — only a crash leftover (a
+     * receipt still `reserved` at startup) ever asks.
+     */
+    findRunIdsByAutomationReceipt(receiptIds) {
+        const wanted = new Set(receiptIds);
+        const found = new Map();
+        const receiptOf = (run) => run.automation?.receiptId ?? run.automationTrigger?.receiptId;
+        for (const run of this.held.values()) {
+            const receipt = receiptOf(run);
+            if (receipt !== undefined && wanted.has(receipt))
+                found.set(receipt, run.id);
+        }
+        const missing = [...wanted].filter((receipt) => !found.has(receipt));
+        if (missing.length === 0 || !this.db)
+            return found;
+        const where = "json_extract(data, '$.automation.receiptId') IN (SELECT value FROM json_each(?))" +
+            " OR json_extract(data, '$.automationTrigger.receiptId') IN (SELECT value FROM json_each(?))";
+        for (const key of this.db.listKeysWhere(where, [JSON.stringify(missing), JSON.stringify(missing)])) {
+            if (this.held.has(key.id) || this.deleted.has(key.id))
+                continue;
+            const run = this.getRun(key.id);
+            const receipt = run && receiptOf(run);
+            if (receipt !== undefined && wanted.has(receipt) && !found.has(receipt))
+                found.set(receipt, key.id);
+        }
+        return found;
+    }
+    /** The id of every root whose delegation carries a conversation, held or stored: recovery's full
+     *  reconcile pass (#661). Only roots' records are read, in SQLite. `naming` keeps the ledgers whose
+     *  messages name that run id, filtered there too, so a deleted peer decodes no other root. */
+    listConversationRootIds(naming) {
+        const where = `json_extract(summary, '$.delegation.role') = 'root' AND json_extract(data, '$.delegation.conversation') IS NOT NULL${naming ? " AND instr(json_extract(data, '$.delegation.conversation.messages'), ?) > 0" : ''}`;
+        const ids = new Set((this.db?.listKeysWhere(where, naming ? [naming] : []) ?? []).map((key) => key.id));
+        for (const id of this.deleted)
+            ids.delete(id);
+        for (const [id, run] of this.held) {
+            if (run.delegation?.role === 'root' && run.delegation.conversation && (!naming || run.delegation.conversation.messages.some(message => [message.senderRunId, message.recipientRunId].includes(naming))))
+                ids.add(id);
+            else
+                ids.delete(id);
+        }
+        return [...ids];
+    }
+    /** The id of every run, held or stored, without decoding any (orphan-worktree sweeps). */
+    listRunIds() {
+        const ids = new Set(this.db?.listIds() ?? []);
+        for (const id of this.deleted)
+            ids.delete(id);
+        for (const id of this.held.keys())
+            ids.add(id);
+        return [...ids];
+    }
+    /** Runs with a materialized worktree directory (`worktreePath`, not reclaimed), most recently
+     *  finished first, then newest first: worktree retention and the worktrees panel. */
+    listRunsWithWorktree() {
+        const runs = this.queryRuns(this.db?.listWithWorktree() ?? [], (run) => run.worktreePath !== undefined && run.worktreeReclaimedAt === undefined);
+        const recency = ([run]) => run.finishedAt ?? run.createdAt;
+        return runs.sort((a, b) => (recency(a) < recency(b) ? 1 : recency(a) > recency(b) ? -1 : newestFirst(a[1], b[1]))).map(([run]) => run);
+    }
+    /**
+     * Every run that owns a branch or names the PR it created, as the few fields branch cleanup and
+     * git-log attribution read (issue 08 §B3, §B5; a squash commit is attributed by its PR number):
+     * the stored summary plus the `branch` and `base_branch` columns, so a Git-tab request decodes
+     * no record. Held runs answer from memory.
+     */
+    listBranchOwners() {
+        const owners = new Map();
+        for (const row of this.db?.listBranchOwners("branch IS NOT NULL OR json_extract(summary, '$.pullRequestUrl') IS NOT NULL") ?? []) {
+            if (this.deleted.has(row.id) || this.held.has(row.id))
+                continue;
+            const summary = parseStoredSummary(row.summary);
+            owners.set(row.id, {
+                id: row.id, createdAt: row.createdAt, status: row.status, archived: row.archived,
+                ...(row.branch === null ? {} : { branch: row.branch }),
+                ...(row.baseBranch === null ? {} : { baseBranch: row.baseBranch }),
+                title: summary?.title ?? row.id,
+                ...(summary?.pullRequestUrl === undefined ? {} : { pullRequestUrl: summary.pullRequestUrl }),
+            });
+        }
+        for (const run of this.held.values()) {
+            const owner = branchOwnerOf(run);
+            if (owner)
+                owners.set(run.id, owner);
+        }
+        return [...owners.values()];
+    }
+    /** The rows a column query returned, as records, with memory laid over them: a held run
+     *  answers from memory (matching `matches` there, not on its maybe-older row). */
+    queryRuns(rows, matches) {
+        const runs = new Map();
+        for (const run of this.held.values())
+            if (matches(run))
+                runs.set(run.id, [run, this.listOrder(run)]);
+        for (const row of rows) {
+            if (runs.has(row.id) || this.held.has(row.id) || this.deleted.has(row.id))
+                continue;
+            const run = this.fromRow(row);
+            if (run && matches(run))
+                runs.set(row.id, [run, row]);
+        }
+        return [...runs.values()];
+    }
+    /** The run an idempotent start already created (#504), archived or not. A deleted run is gone
+     *  with its record, so a retry after deletion honestly creates a fresh one. */
+    findRunByClientRequestId(clientRequestId) {
+        for (const run of this.held.values())
+            if (run.clientRequestId === clientRequestId)
+                return run;
+        const row = this.db?.findByClientRequestId(clientRequestId);
+        if (!row || this.held.has(row.id))
+            return undefined;
+        const run = this.getRun(row.id);
+        return run?.clientRequestId === clientRequestId ? run : undefined;
+    }
+    createRun(input) {
+        if (this.openFailure)
+            throw this.openFailure;
+        const run = this.buildRun(input, randomUUID());
+        // A new family, so nobody else can hold it; claimed before anything (an NDJSON event) is written.
+        if (this.db && !this.claimFamilies([run.id]).has(run.id))
+            throw new RunWriteRefusedError(run.id, 'foreign');
+        this.held.set(run.id, run);
+        this.pruneOldRuns();
+        this.touch(run);
+        return run;
+    }
+    /** Build without publishing: owned creation must commit its receipt and run together. */
+    buildRun(input, id) {
+        const run = {
+            id,
+            // Scrubbed on the way in, exactly as `updateRun` scrubs it on the way
+            // through (#456 review) — a token pasted into the prompt otherwise sat
+            // verbatim in `runs.json` from creation. `task` is deliberately NOT
+            // scrubbed: it is the user's own prompt and is replayed into `{{task}}`
+            // when a queued run is revived after a restart (#367), so redacting it
+            // would corrupt the revived run.
+            title: this.redactText(input.title),
+            workflow: input.workflow,
+            task: input.task,
+            model: input.model,
+            systemPrompt: input.systemPrompt,
+            workflowDef: input.workflowDef === undefined ? undefined : workflowDefSchema.parse(input.workflowDef),
+            effort: input.effort,
+            runner: input.runner,
+            agentProfile: input.agentProfile,
+            autonomous: input.autonomous,
+            archiveWhenDone: input.archiveWhenDone,
+            autoMergePr: input.autoMergePr, allowWorkers: input.allowWorkers, allowMessaging: input.allowMessaging,
+            ...(input.notify ? { notify: true } : {}),
+            worktree: input.worktree,
+            groupId: input.groupId,
+            variant: input.variant,
+            ...(input.clientRequestId === undefined ? {} : { clientRequestId: input.clientRequestId, clientRequestHash: input.clientRequestHash }),
+            ...(input.automation ? { automation: input.automation } : {}),
+            ...(input.automationTrigger ? { automationTrigger: input.automationTrigger } : {}),
+            status: 'queued',
+            createdAt: new Date().toISOString(),
+            tokensUsed: 0,
+            archived: false,
+            steps: input.steps.map((s) => ({
+                ...s,
+                status: 'pending',
+                iterations: 0,
+                tokensUsed: 0,
+            })),
+        };
+        // A prompt that pastes a PR or issue URL is already about that item — seed
+        // both referenced tiers so queued runs can expose the reference before the
+        // first agent event (#407, #554).
+        trackReferencedPrs(run, input.task, this.repoHandle);
+        trackReferencedIssues(run, input.task, this.repoHandle);
+        return run;
+    }
+    /** Accept the family ledger and its recipient queue in a single durable index replacement. A new
+     *  message (`message`, or the delivered input) whose ID is in use writes nothing; `recipientDelegation`
+     *  makes a peer recipient with no delegation record a root task in the same write. */
+    commitConversation(rootId, conversation, delivery, message) {
+        const root = this.peek(rootId);
+        if (root?.delegation?.role !== 'root')
+            throw new Error('missing conversation root');
+        assertConversationIdFree(root, message ?? delivery?.input, id => this.peek(id), (runId, id) => this.hasProjection(runId, id));
+        const staged = new Map();
+        stageConversation(staged, root, conversation, delivery, id => this.peek(id), text => this.redactText(text));
+        this.commitIndex(staged);
+    }
+    /** Crash recovery (#505): input a harness accepted but was never seen reading goes
+     * back to the queue. Returns the requeued IDs. */
+    requeueAwaitingReadInputs(id) {
+        const ids = (this.peek(id)?.agentInputs ?? []).filter(input => input.awaitingRead && input.deliveredAt && !input.consumedAt).map(input => input.id);
+        if (ids.length)
+            this.commitOutcome(id, { kind: 'requeued', inputIds: ids });
+        return ids;
+    }
+    /** Delivered, but the harness never confirmed reading it (#505): stop awaiting a read. */
+    commitAgentInputsUnconfirmed(id, ids) {
+        const run = this.peek(id);
+        if (!run?.agentInputs || !ids.length)
+            return;
+        this.commitAgentInputs(id, run.agentInputs.map(input => {
+            if (!ids.includes(input.id) || !input.awaitingRead)
+                return input;
+            const { awaitingRead: _awaiting, ...unconfirmed } = input;
+            return unconfirmed;
+        }));
+    }
+    /** Observable atomic input checkpoint for the queue itself: enqueue, retire, reorder. Delivery
+     *  and reads are outcomes (`commitOutcome`). */
+    commitAgentInputs(id, inputs) {
+        const run = this.peek(id);
+        if (!run)
+            throw new Error('missing agent input target');
+        const agentInputs = inputs.map(input => agentInputSchema.parse(input));
+        // Receipts are outcomes (hearsay-tools/cezarion#1805): only `commitOutcome` writes them.
+        const stored = new Map((run.agentInputs ?? []).map(input => [input.id, input]));
+        if (agentInputs.some(input => input.deliveredAt !== stored.get(input.id)?.deliveredAt || input.consumedAt !== stored.get(input.id)?.consumedAt)) {
+            throw new Error('agent input receipts change only through commitOutcome');
+        }
+        const now = new Date().toISOString();
+        for (const input of run.agentInputs ?? []) {
+            const claim = input.inboxClaim;
+            if (!claim || claim.acknowledgedAt || claim.expiresAt <= now)
+                continue;
+            const matching = agentInputs.filter(next => next.id === input.id);
+            if (matching.length !== 1 || !isDeepStrictEqual(matching[0].inboxClaim, claim)) {
+                throw new Error('live inbox receipt changed');
+            }
+        }
+        this.commitIndex(new Map([[id, { ...run, agentInputs }]]));
+    }
+    /** Reserve only unread conversation inputs in one durable index replacement. */
+    claimInboxInputs(runId, ids, claim) {
+        const run = this.peek(runId);
+        if (!run)
+            throw new Error('missing inbox recipient');
+        const selected = z.array(z.uuid()).min(1).max(32).refine(values => new Set(values).size === values.length).parse(ids);
+        const receipt = inboxClaimSchema.parse({ ...claim, memberIds: selected });
+        if (receipt.acknowledgedAt || receipt.expiresAt <= new Date().toISOString())
+            throw new Error('inbox claim is not live');
+        const inputs = run.agentInputs ?? [];
+        if (inputs.some(input => input.inboxClaim?.receiptId === receipt.receiptId))
+            throw new Error('inbox receipt already exists');
+        for (const id of selected) {
+            const matching = inputs.filter(input => input.id === id);
+            if (matching.length !== 1 || matching[0]?.source !== 'agent' || !matching[0].conversation ||
+                matching[0].deliveredAt || (matching[0].inboxClaim && matching[0].inboxClaim.expiresAt > new Date().toISOString())) {
+                throw new Error('inbox input is not available');
+            }
+        }
+        const selectedIds = new Set(selected);
+        this.commitIndex(new Map([[runId, { ...run, agentInputs: inputs.map(input => selectedIds.has(input.id)
+                        ? agentInputSchema.parse({ ...input, inboxClaim: receipt }) : input) }]]));
+    }
+    /** A receipt owns every matching input or none; exact ACK retries preserve the first timestamp. */
+    ackInboxInputs(runId, receiptId, generation, at) {
+        const run = this.peek(runId);
+        if (!run)
+            throw new Error('missing inbox recipient');
+        inboxClaimSchema.shape.receiptId.parse(receiptId);
+        inboxClaimSchema.shape.generation.parse(generation);
+        inboxClaimSchema.shape.expiresAt.parse(at);
+        const matching = (run.agentInputs ?? []).filter(input => input.inboxClaim?.receiptId === receiptId);
+        const receipt = matching[0]?.inboxClaim;
+        const memberIds = receipt?.memberIds;
+        if (!memberIds || matching.length !== memberIds.length ||
+            !memberIds.every(id => matching.some(input => input.id === id)) ||
+            matching.some(input => !isDeepStrictEqual(input.inboxClaim, receipt)) ||
+            matching.some(input => input.inboxClaim?.generation !== generation ||
+                input.source !== 'agent' || !input.conversation))
+            throw new Error('inbox receipt changed');
+        if (matching.every(input => input.inboxClaim?.acknowledgedAt && input.deliveredAt === input.inboxClaim.acknowledgedAt)) {
+            return 'already-acknowledged';
+        }
+        if (matching.some(input => input.deliveredAt || input.inboxClaim?.acknowledgedAt || input.inboxClaim.expiresAt <= at)) {
+            throw new Error('inbox receipt expired or displaced');
+        }
+        this.commitOutcome(runId, { kind: 'inbox-acknowledged', receiptId, at });
+        return 'acknowledged';
+    }
+    releaseInboxInputs(runId, receiptId, generation) {
+        const run = this.peek(runId);
+        if (!run)
+            throw new Error('missing inbox recipient');
+        inboxClaimSchema.shape.receiptId.parse(receiptId);
+        inboxClaimSchema.shape.generation.parse(generation);
+        const matching = (run.agentInputs ?? []).filter(input => input.inboxClaim?.receiptId === receiptId);
+        if (!matching.length || matching.some(input => input.inboxClaim?.generation !== generation ||
+            input.inboxClaim?.acknowledgedAt || input.deliveredAt))
+            throw new Error('inbox receipt changed');
+        this.commitIndex(new Map([[runId, { ...run, agentInputs: run.agentInputs.map(input => {
+                        if (input.inboxClaim?.receiptId !== receiptId)
+                            return input;
+                        const { inboxClaim: _claim, ...unclaimed } = input;
+                        return agentInputSchema.parse(unclaimed);
+                    }) }]]));
+        return 'released';
+    }
+    clearExpiredInboxClaims(runId, now) {
+        const run = this.peek(runId);
+        if (!run)
+            throw new Error('missing inbox recipient');
+        inboxClaimSchema.shape.expiresAt.parse(now);
+        if (!run.agentInputs?.some(input => input.inboxClaim && !input.inboxClaim.acknowledgedAt && input.inboxClaim.expiresAt <= now))
+            return;
+        this.commitIndex(new Map([[runId, { ...run, agentInputs: run.agentInputs.map(input => {
+                        if (!input.inboxClaim || input.inboxClaim.acknowledgedAt || input.inboxClaim.expiresAt > now)
+                            return input;
+                        const { inboxClaim: _claim, ...unclaimed } = input;
+                        return agentInputSchema.parse(unclaimed);
+                    }) }]]));
+    }
+    /**
+     * A wait and its wake input share one atomic index replacement (spec 2026-10-17-unified-waits).
+     * Upserts `wait` by id into `waits` and clears `lastWaitsError`; `input` is appended once (an
+     * input whose id is already queued stays as it is). Only an open or resolved wait is committed
+     * here: settling is an outcome (`commitOutcome`). A new open wait
+     * past `WAIT_LIMIT` open ones is refused, so the list stays bounded whatever the caller checked.
+     */
+    commitWait(id, wait, input, registration) {
+        const run = this.peek(id);
+        if (!run)
+            throw new Error('missing wait target');
+        this.commitIndex(new Map([[id, registeredWaitRecord(run, wait, input, registration)]]));
+    }
+    /** Record a deduplicated registration without mutating its wait. */
+    commitWaitRegistration(id, receipt) {
+        const run = this.peek(id);
+        if (!run)
+            throw new Error('missing wait target');
+        this.commitIndex(new Map([[id, registeredReceiptRecord(run, receipt)]]));
+    }
+    /** A usage-limit appointment withdrawn, committed at once instead of on the debounced save
+     *  (hearsay-tools/cezarion#1236): a crash right after the withdrawal must not find it on disk,
+     *  or recovery re-arms work the user cancelled. A run held for its resume settles `failed` by
+     *  the `withdraw-hold` exit; any other run only loses its resume fields. */
+    commitAutoResumeWithdrawal(id) {
+        const run = this.peek(id);
+        if (!run || (run.autoResumeAt === undefined && run.autoResumeAttempts === undefined))
+            return;
+        if (isUsageLimitHold(run))
+            this.move(id, 'withdraw-hold');
+        else
+            this.commitIndex(new Map([[id, { ...run, autoResumeAt: undefined, autoResumeAttempts: undefined }]]));
+    }
+    /** A human message beside a run's waits (hearsay-tools/cezarion#1235): accepted durably, and
+     *  every wait stays. A lifecycle opening becomes
+     *  the human's and keeps its wake text, so the message opens the continuation (and answers a
+     *  pending question) and the owed results still reach the agent. */
+    commitHumanMessageBesideWaits(id, acceptedHumanMessage) {
+        const run = this.peek(id);
+        if (!run)
+            throw new Error('missing queued message target');
+        this.commitIndex(new Map([[id, { ...run, queuedMessages: [...(run.queuedMessages ?? []), queuedMessageSchema.parse(acceptedHumanMessage)],
+                    ...(run.continuationMessage ? { continuationMessage: { ...run.continuationMessage, origin: 'human' } } : {}),
+                }]]));
+    }
+    /**
+     * The one write of a run outcome (hearsay-tools/cezarion#1805): an input or wait delivered, a wake
+     * charged, a wait settled, a question answered, staged by `applyOutcomes` with what it depends on
+     * (`deps`) and committed in one transaction, with every pending row. A crash keeps all of it or
+     * none. Nothing changes: nothing is written. Needs no live session: it reads the stored record.
+     *
+     * A refused write throws with nothing changed. `bestEffort` is for a cleanup path, which must
+     * never stop on it: it warns and applies the change in memory for the debounced save to retry.
+     * A conversation request outcome is the other sanctioned write: `commitConversation`.
+     */
+    commitOutcome(id, outcomes, deps = {}, opts = {}) {
+        const run = this.peek(id);
+        if (!run)
+            return { committed: false, answered: [], settled: [] };
+        const staged = applyOutcomes(run, Array.isArray(outcomes) ? outcomes : [outcomes], deps);
+        if (!staged.changed)
+            return { committed: false, answered: [], settled: [] };
+        try {
+            this.commitIndex(new Map([[id, staged.next]]));
+        }
+        catch (error) {
+            if (!opts.bestEffort)
+                throw error;
+            console.warn(`${logPrefix()} outcome checkpoint failed: ${error instanceof Error ? error.message : String(error)}`);
+            const live = this.record(id);
+            if (!live)
+                return { committed: false, answered: staged.answered, settled: staged.settled };
+            for (const key of Object.keys(live))
+                if (!(key in staged.next))
+                    delete live[key];
+            Object.assign(live, staged.next);
+            this.touch(live);
+            return { committed: false, answered: staged.answered, settled: staged.settled };
+        }
+        return { committed: true, answered: staged.answered, settled: staged.settled };
+    }
+    /** An acknowledged inactive-root Finish must survive the async diff and restart. */
+    commitRootFinishIntent(id) {
+        const run = this.peek(id);
+        if (run?.status !== 'waiting' || run.delegation?.role !== 'root')
+            throw new Error('root is not waiting');
+        if (run.delegation.finishRequestedAt)
+            return;
+        this.commitDelegation([{ id, delegation: { ...run.delegation, finishRequestedAt: new Date().toISOString() } }]);
+    }
+    /** Persist all authority patches before exposing any of them to the engine or subscribers. */
+    commitDelegation(patches) {
+        if (patches.length === 0)
+            return;
+        const staged = new Map();
+        let destroyProgress = true;
+        for (const patch of patches) {
+            const run = this.peek(patch.id);
+            if (!run || staged.has(patch.id))
+                throw new Error('missing or duplicate delegation patch target');
+            const delegation = delegationStateSchema.parse(patch.delegation);
+            if (!isDestroyProgress(run.delegation, delegation))
+                destroyProgress = false;
+            staged.set(patch.id, { ...run, delegation });
+        }
+        // In-process cause only: consumers can skip metadata replay when delegation
+        // is disabled without dropping real status or termination-proof notifications.
+        this.commitIndex(staged, destroyProgress ? 'delegation-destroy-progress' : 'delegation-checkpoint');
+    }
+    /** A pending destroy's automatic retry state, or its removal (hearsay-tools/cezarion#879). Kept on
+     * the record beside the strict delegation, so an older cezar strips it rather than quarantining the
+     * worker. Destroy progress: nothing the family reconcile reads changes. */
+    commitDestroyRetry(id, retry) {
+        const run = this.peek(id);
+        if (run?.delegation?.role !== 'worker' || !run.delegation.destroy)
+            throw new Error('missing pending destroy');
+        if (!retry && !run.destroyRetry)
+            return;
+        // An explicit `undefined`, not an omitted key: commitIndex assigns onto the live record.
+        this.commitIndex(new Map([[id, { ...run, destroyRetry: retry ? workerDestroyRetrySchema.parse(retry) : undefined }]]), 'delegation-destroy-progress');
+    }
+    /** Accepted execution revision is public lifecycle identity, separate from process generations. */
+    commitWorkerContinuation(id, exit, patch = {}, step, conversation) {
+        const run = this.peek(id);
+        if (run?.delegation?.role !== 'worker')
+            throw new Error('missing worker continuation target');
+        const delegation = delegationStateSchema.parse({ ...run.delegation,
+            executionRevision: (run.delegation.executionRevision ?? 0) + 1,
+            executionStartSeq: this.transcriptFacts(id).lastSeq,
+        });
+        const staged = new Map();
+        this.exitEvents.started(id);
+        const next = { ...run, ...applyExit(run, exit, this.redactPatch(patch)), delegation,
+            ...(step ? { steps: [...run.steps, { ...step, status: 'pending', iterations: 0, tokensUsed: 0 }] } : {}),
+        };
+        staged.set(id, next);
+        if (Object.prototype.hasOwnProperty.call(patch, 'archived'))
+            this.syncTranscriptForm(id, next.archived);
+        if (conversation) {
+            const root = this.peek(conversation.rootId);
+            if (root?.delegation?.role !== 'root' || run.delegation.parentRunId !== root.id)
+                throw new Error('missing conversation ownership');
+            stageConversation(staged, root, conversation.state, { recipientRunId: id, input: conversation.input }, runId => this.peek(runId), text => this.redactText(text));
+        }
+        this.commitIndex(staged);
+    }
+    workerResultsDir(parentId, write = false) { return workerResultsDirectory(write ? this.writeDir(parentId) : this.sourceDataDir(parentId), parentId, write); }
+    workerResultSnapshotPath(parentId, workerId, snapshotId) {
+        return join(this.dataDir, 'runs', `${z.uuid().parse(parentId)}-worker-results`, `${z.uuid().parse(workerId)}.${z.uuid().parse(snapshotId)}.json`);
+    }
+    readWorkerResultFile(parentId, workerId) {
+        const parent = this.peek(parentId);
+        if (parent?.delegation?.role !== 'root' || !parent.delegation.receipts.some(receipt => receipt.workerId === workerId))
+            return undefined;
+        const reference = parent.delegation.results?.find(result => result.workerId === workerId);
+        if (!reference)
+            return undefined;
+        try {
+            const path = join(this.workerResultsDir(parentId), `${z.uuid().parse(workerId)}.${z.uuid().parse(reference.snapshotId)}.json`);
+            const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+            let raw;
+            try {
+                const info = fstatSync(fd);
+                if (!info.isFile() || info.size > 3_145_728)
+                    return undefined;
+                raw = readFileSync(fd, 'utf8');
+            }
+            finally {
+                closeSync(fd);
+            }
+            const file = workerResultFileSchema.parse(JSON.parse(raw));
+            if (!bindWorkerResultPath(file.result.diff, this.dataDir, this.hasFallbackRun(parentId), parentId, path))
+                return undefined;
+            if (file.result.parentRunId !== parentId || file.result.workerId !== workerId || file.result.workspace.ownerRunId !== workerId || file.result.revision !== reference.revision || file.result.observedAt !== reference.observedAt ||
+                (file.result.diff.state === 'available' && (file.result.diff.snapshotId !== reference.snapshotId || file.diffSnapshot === undefined)))
+                return undefined;
+            return file;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    readWorkerResult(parentId, workerId) {
+        return this.readWorkerResultFile(parentId, workerId)?.result;
+    }
+    readWorkerResultDiff(parentId, workerId) {
+        return this.readWorkerResultFile(parentId, workerId)?.diffSnapshot;
+    }
+    /** Publish a pointer only after its redacted immutable snapshot reaches disk. */
+    commitWorkerResult(parentId, value, diffSnapshot, opts = {}) {
+        return commitStoreWorkerResult({
+            redactResult: (result) => this.redact({ type: 'worker-result', seq: 0, ts: result.observedAt, result }).result,
+            peek: (id) => this.peek(id),
+            readWorkerResultFile: (id, workerId) => this.readWorkerResultFile(id, workerId),
+            readWorkerResult: (id, workerId) => this.readWorkerResult(id, workerId),
+            redactText: (text) => this.redactText(text),
+            workerResultSnapshotPath: (id, workerId, snapshotId) => this.workerResultSnapshotPath(id, workerId, snapshotId),
+            workerResultsDir: (id) => this.workerResultsDir(id, true),
+            commitDelegation: (patches) => this.commitDelegation(patches),
+        }, parentId, value, diffSnapshot, opts);
+    }
+    /** Create an owned worker run and its parent receipt; `createStoreOwnedRun` holds the checks. */
+    createOwnedRun(input, parentId, requestId, worker, requestHash, executionIdentity = { kind: 'internal' }) {
+        return createStoreOwnedRun({
+            peek: (id) => this.peek(id),
+            hasRun: (id) => this.hasRun(id),
+            held: this.held, deleted: this.deleted, db: this.db,
+            buildRun: (ownedInput, id) => this.buildRun(ownedInput, id),
+            writeWorkerIdentity: (id, identity) => this.writeWorkerIdentity(id, identity),
+            writeWorkerExecution: (id, proof, fresh) => this.writeWorkerExecution(id, proof, fresh),
+            commitIndex: (owned) => this.commitIndex(owned),
+        }, input, parentId, requestId, worker, requestHash, executionIdentity);
+    }
+    /**
+     * Durably replace or delete staged rows together with pending dirty rows. Persist before
+     * changing held objects or notifying subscribers. On failure retain all pending state; flush()
+     * remains best-effort.
+     */
+    commitIndex(input, source) {
+        const staged = stageCommit(input, {
+            peek: id => this.peek(id),
+            completionArchiveBlocker: run => this.completionArchiveBlocker(run),
+            stageArchive: (staged, run, archived) => this.stageArchive(staged, run, archived),
+        });
+        if (!this.db)
+            throw this.openFailure ?? new Error('runs database unavailable: nothing can be saved');
+        this.assertWritable(staged);
+        this.persist(staged);
+        // Preserve existing record references, but expose the entire transaction before its first event.
+        // A finished run joins the held set for the commit and leaves at the next sweep.
+        for (const [id, next] of staged) {
+            this.coldReads.forget(id);
+            if (!next) {
+                this.held.delete(id);
+                continue;
+            }
+            this.committing.add(id);
+            const current = this.held.get(id);
+            if (current) {
+                for (const key of Object.keys(current)) {
+                    if (!(key in next))
+                        delete current[key];
+                }
+                Object.assign(current, next);
+            }
+            else
+                this.held.set(id, next);
+        }
+        try {
+            for (const id of staged.keys()) {
+                const run = this.held.get(id);
+                if (run)
+                    this.emit('run', run, source);
+                else
+                    this.emit('deleted', id);
+            }
+        }
+        finally {
+            for (const id of staged.keys())
+                this.committing.delete(id);
+            this.sweepIfSettled(staged.keys());
+        }
+        for (const [id, next] of staged)
+            if (next?.archived)
+                this.compressor.enqueue(id);
+    }
+    completionArchiveBlocker(root) {
+        const family = [root, ...this.listWorkersOf(root.id)];
+        for (const run of family) {
+            const facts = this.factsFor(run.id).peek(run.id);
+            if (!facts || !['done', 'review', 'failed', 'cancelled'].includes(run.status) || run.waits?.some(wait => wait.phase === 'open') ||
+                run.hasPendingPermission || facts.pendingAsk !== undefined)
+                return 'Task or worker work still needs attention. Open the task or archive manually.';
+            if (run.delegation?.role === 'invalid' || (run.delegation?.role === 'worker' && this.readWorkerExecution(run.id)?.phase !== 'complete'))
+                return 'Worker execution has not settled. Open the worker or archive manually.';
+        }
+        return undefined;
+    }
+    /** One archive write for manual actions, merge observations, completion, and sweeps.
+     * Archiving files history away; it never stops a process or removes a worktree. */
+    stageArchive(staged, root, archived) {
+        const ids = root.delegation?.role === 'worker' ? [root.id] :
+            [root.id, ...new Set([...(this.db?.listIdsByParent(root.id) ?? []), ...this.listWorkersOf(root.id).map(run => run.id)])];
+        const now = new Date().toISOString();
+        for (const id of ids) {
+            const member = staged.get(id) ?? this.peek(id);
+            if (!member)
+                continue;
+            if (!archived) {
+                this.compressor.cancel(id);
+                restoreHistory(this.dataDir, id);
+            }
+            const next = { ...member, archiveBlocker: undefined };
+            archiveFields(next, archived, now);
+            staged.set(id, next);
+        }
+    }
+    /** A bounded persisted queue also covers projects without a live RunManager. */
+    listCompletionCandidates(afterSeq = 0, limit = 32) {
+        return this.db?.listCompletionCandidates(afterSeq, limit) ?? [];
+    }
+    canCompleteAction(id, token) {
+        const run = this.record(id);
+        return Boolean(run && run.status === 'done' && !run.archived && (run.autoMergePr || run.archiveWhenDone) &&
+            run.completionAction?.id === token && run.completionAction.phase !== 'complete' && !this.writeRefusal(id));
+    }
+    claimCompletionAction(id, token) {
+        if (!this.canCompleteAction(id, token))
+            return false;
+        const run = this.record(id);
+        this.assertWritable(new Map([[id, run]]));
+        // A normal write may defer its claim until the transaction. A remote mutation
+        // needs the committed claim now, and must not act on a stale row read before it.
+        const claim = this.db?.getClaim(familyKey(run));
+        return Boolean(claim && claim.session === this.owner?.session &&
+            claim.generation === this.claimed.get(familyKey(run)) &&
+            this.db?.get(id)?.revision === this.base.get(id)?.revision);
+    }
+    completeAction(id, token, phase, message) {
+        const run = this.record(id);
+        if (!run || !this.canCompleteAction(id, token))
+            return false;
+        if (run.completionAction?.phase === phase && run.completionAction.message === message)
+            return true;
+        const next = { ...run, completionAction: { id: token, phase, ...(message ? { message } : {}) } };
+        const staged = new Map([[id, next]]);
+        if (phase === 'complete' && next.archiveWhenDone) {
+            const blocker = this.completionArchiveBlocker(next);
+            if (blocker)
+                next.completionAction = { id: token, phase: 'blocked', message: blocker };
+            else
+                this.stageArchive(staged, next, true);
+        }
+        this.commitIndex(staged);
+        return true;
+    }
+    /**
+     * Refuse (throwing, with nothing changed) a commit that stages a quarantined run, or a run whose
+     * family this store does not claim and cannot take: another process owns it, or a dead process
+     * left it live and it has not been adopted.
+     */
+    assertWritable(staged) {
+        const families = new Map();
+        const held = new Set();
+        for (const [id, next] of staged) {
+            if (this.quarantined.has(id))
+                throw new RunWriteRefusedError(id, 'quarantined');
+            const family = next ? familyKey(next) : this.familyOf(id);
+            families.set(id, family);
+            if (this.held.has(id))
+                held.add(family);
+        }
+        // A run this store holds may move to a new family; any other row is claimed as a plain write.
+        const owned = new Set([...this.claimFamilies(held, { allowLive: true }),
+            ...this.claimFamilies([...families.values()].filter((family) => !held.has(family)))]);
+        for (const [id, family] of families) {
+            if (!owned.has(family))
+                throw this.runOwnership(id) === 'fallback' ? this.fallbackRefusal(id) : new RunWriteRefusedError(id, this.runOwnership(id) === 'orphaned' ? 'orphaned' : 'foreign');
+        }
+    }
+    /** The family of a run this store knows: held, else its row; a run nowhere is its own. */
+    familyOf(id) {
+        const held = this.held.get(id);
+        return held ? familyKey(held) : this.deletedFamilies.get(id) ?? this.db?.familyOf(id) ?? id;
+    }
+    /** Schedule the sweep that lets any of `ids` leave memory, when one of them now can. */
+    sweepIfSettled(ids) {
+        for (const id of ids) {
+            const run = this.held.get(id);
+            if (run && !this.isAnchor(id, run)) {
+                this.scheduleSave();
+                return;
+            }
+        }
+    }
+    /** Move run `id` by `exit` (ADR 0056): its status and `extras` in one write, checked against the
+     *  record that write changes. A run this store cannot write is neither checked nor written. The
+     *  exit decides how the write persists (`exitDurability`), never the extras. A guarded exit (one
+     *  with a `guard` or a `settle`) commits at once, and writes nothing when its guard fails: undefined, or its
+     *  `refused` error. `call` names the step the exit settles apart from the others, and the text
+     *  of the lifecycle event it writes after the write (`exitEvent`). */
+    move(id, exit, extras = {}, call = {}) {
+        const spec = RUN_EXITS[exit];
+        const guarded = Boolean(spec.guard || spec.settle);
+        const run = guarded ? this.peek(id) : this.record(id);
+        if (!run || spec.guard?.(run) === false) {
+            if (spec.refused)
+                throw new Error(spec.refused);
+            return undefined;
+        }
+        const event = this.exitEvents.owed(id, exit, run.status, call);
+        // Redacted first: a step the exit settles takes the run's error.
+        const redacted = this.redactPatch(extras);
+        let moved;
+        if (!guarded)
+            moved = this.writeRun(id, run, applyExit(run, exit, redacted, call), exitDurability(exit, run));
+        else {
+            const input = { ...run, ...redacted };
+            this.commitIndex(new Map([[id, { ...(spec.settle?.(input, { ...call, now: new Date().toISOString() }) ?? input), ...applyExit(run, exit, {}, call) }]]));
+            moved = this.peek(id);
+        }
+        if (event)
+            this.exitEvents.write(id, event);
+        return moved;
+    }
+    /** A write that is not a run exit. It commits at once when it changes handoff records, a
+     *  completion option or task access, else the next save writes it. A status in the patch, which only test
+     *  fixtures still write, takes the exit's record rule (`doneCommits`). */
+    updateRun(id, patch) {
+        const run = this.record(id);
+        if (!run)
+            return undefined;
+        const committed = (patch.status === 'done' && doneCommits(run)) || patch.handoffRecords !== undefined ||
+            [patch.archiveWhenDone, patch.autoMergePr, patch.allowWorkers, patch.allowMessaging].some(value => value !== undefined);
+        return this.writeRun(id, run, patch, committed ? 'committed' : 'debounced');
+    }
+    /** One update of the held record `run`: committed at once, or written to the record for the next
+     *  save. A debounced write is best-effort, so a locked database cannot stop cleanup. */
+    writeRun(id, run, patch, durability) {
+        const hooks = {
+            redact: (text) => this.redactText(text),
+            repoHandle: this.repoHandle,
+            restore: () => restoreHistory(this.dataDir, id),
+            archive: (record, archived) => this.applyArchived(record, archived),
+            touch: (record) => this.touch(record),
+        };
+        if (durability === 'committed') {
+            this.commitIndex(new Map([[id, stageDurableUpdate(run, patch, hooks)]]));
+            return this.record(id);
+        }
+        stageDebouncedUpdate(run, patch, hooks);
+        return run;
+    }
+    redactPatch(patch) {
+        return redactPatch(patch, text => this.redactText(text));
+    }
+    /** Append a step to an existing run (used by "Continue" — spec 003). */
+    addStep(runId, step) {
+        const run = this.record(runId);
+        if (!run || run.steps.some((s) => s.id === step.id))
+            return;
+        run.steps.push({ ...step, status: 'pending', iterations: 0, tokensUsed: 0 });
+        this.touch(run);
+    }
+    updateStep(runId, stepId, patch) {
+        const run = this.record(runId);
+        const step = run?.steps.find((s) => s.id === stepId);
+        if (!run || !step)
+            return;
+        Object.assign(step, stageStepUpdate(patch, text => this.redactText(text)));
+        run.tokensUsed = run.steps.reduce((sum, s) => sum + s.tokensUsed, 0);
+        const startedAgentSteps = run.steps.filter((candidate) => candidate.kind === 'agent' && candidate.iterations > 0);
+        const directionalComplete = startedAgentSteps.length > 0 &&
+            startedAgentSteps.every((candidate) => candidate.usageInvocationsStarted !== undefined &&
+                candidate.usageInvocationsObserved !== undefined &&
+                candidate.usageInvocationsObserved > 0 &&
+                candidate.usageInvocationsStarted === candidate.usageInvocationsObserved &&
+                candidate.usageTurnsStarted !== undefined &&
+                candidate.usageTurnsRecorded !== undefined &&
+                candidate.usageTurnsStarted > 0 &&
+                candidate.usageTurnsStarted === candidate.usageTurnsRecorded &&
+                candidate.inputTokens !== undefined &&
+                candidate.outputTokens !== undefined);
+        run.inputTokens = directionalComplete
+            ? startedAgentSteps.reduce((sum, candidate) => sum + (candidate.inputTokens ?? 0), 0)
+            : undefined;
+        run.outputTokens = directionalComplete
+            ? startedAgentSteps.reduce((sum, candidate) => sum + (candidate.outputTokens ?? 0), 0)
+            : undefined;
+        const cost = run.steps.reduce((sum, s) => sum + (s.costUsd ?? 0), 0);
+        run.costUsd = run.steps.some((step) => step.costUsd !== undefined) ? cost : undefined;
+        this.touch(run);
+    }
+    listArchiveOnMergeCandidates(afterSeq = 0, limit = 32) {
+        return this.db?.listArchiveOnMergeCandidates(afterSeq, limit) ?? [];
+    }
+    /** Use unnormalized persisted evidence: cold reads must not turn interrupted work into safety. */
+    archiveFamily(id, isActive) {
+        return archiveStoreFamily({
+            db: this.db,
+            held: this.held,
+            deleted: this.deleted,
+            quarantined: this.quarantined,
+            pins: this.pins,
+            listWorkersOf: (parentId) => this.listWorkersOf(parentId),
+            setArchiveBlocker: (runId, blocker) => this.setArchiveBlocker(runId, blocker),
+            decodeRunRow,
+            decodeCold: (row) => this.decodeCold(row),
+            writeRefusal: (memberId) => this.writeRefusal(memberId),
+            factsPeek: (memberId) => this.factsFor(memberId).peek(memberId),
+            readWorkerExecution: (memberId) => this.readWorkerExecution(memberId),
+        }, id, isActive);
+    }
+    /** Blockers are feedback, never archive authority or cleanup permission. */
+    setArchiveBlocker(id, blocker) {
+        const run = this.record(id);
+        if (!run || run.archived || isDeepStrictEqual(run.archiveBlocker, blocker))
+            return;
+        this.commitIndex(new Map([[id, { ...run, archiveBlocker: blocker }]]));
+    }
+    archiveMergeBlocker(snapshot, missing, repoBase) {
+        const url = `https://github.com/${missing.owner}/${missing.repo}/pull/${missing.number}`;
+        const family = [snapshot.rootId, ...(this.db?.listIdsByParent(snapshot.rootId) ?? [])].flatMap(id => {
+            const run = this.peek(id);
+            return run ? [run] : [];
+        });
+        const member = family.find(run => archivePullRequests([run], repoBase)?.some(pr => pullRequestKey(pr) === pullRequestKey(missing)));
+        this.setArchiveBlocker(snapshot.rootId, { message: `PR ${missing.owner}/${missing.repo}#${missing.number} is not confirmed merged. Check the PR association or archive manually.`,
+            runId: member?.id ?? snapshot.rootId, pullRequestUrl: url });
+    }
+    hasArchiveOnMergeAssociations(id) {
+        return this.db?.archiveFamilyHasPullRequests(id) ?? false;
+    }
+    async prepareArchiveOnMerge(id) {
+        const ids = [id, ...(this.db?.listIdsByParent(id) ?? [])];
+        if (ids.length > 1025)
+            return;
+        for (const memberId of ids)
+            await this.factsFor(memberId).ready(memberId);
+    }
+    archiveOnMergeSnapshot(id, repoBase, isActive = () => false) {
+        const family = this.archiveFamily(id, isActive);
+        if (!family)
+            return undefined;
+        return this.archiveSnapshot(family, repoBase);
+    }
+    archiveSnapshot(family, repoBase) {
+        const pullRequests = archivePullRequests(family, repoBase);
+        if (!pullRequests) {
+            this.setArchiveBlocker(family[0].id, { message: 'PR associations cannot be resolved. Check task and worker PRs, or archive manually.' });
+            return undefined;
+        }
+        const fingerprint = archiveDigest(pullRequests);
+        if (family[0].autoArchive?.fingerprint === fingerprint)
+            return undefined;
+        return { rootId: family[0].id, fingerprint, pullRequests, token: archiveDigest(family.map(({ archiveBlocker: _blocker, ...run }) => run)) };
+    }
+    /** No await between final revalidation and the fenced, all-or-nothing cascade. */
+    archiveAfterMerge(snapshot, observations, repoBase, isActive = () => false) {
+        const family = this.archiveFamily(snapshot.rootId, isActive);
+        if (!family)
+            return false;
+        const current = this.archiveSnapshot(family, repoBase);
+        if (!current || current.token !== snapshot.token || current.fingerprint !== snapshot.fingerprint)
+            return false;
+        const parsed = observations.map(observation => mergedPullRequestSchema.safeParse(observation));
+        if (parsed.some(result => !result.success))
+            return false;
+        const merged = parsed.flatMap(result => result.success ? [result.data] : []);
+        const byKey = new Map(merged.map(pr => [pullRequestKey(pr), pr]));
+        if (byKey.size !== current.pullRequests.length || current.pullRequests.some(pr => !byKey.has(pullRequestKey(pr))))
+            return false;
+        const restoredAt = Math.max(0, ...family.map(run => run.manualUnarchivedAt ? Date.parse(run.manualUnarchivedAt) : 0));
+        if (restoredAt && merged.every(pr => Date.parse(pr.mergedAt) <= restoredAt))
+            return false;
+        const now = new Date().toISOString();
+        if (merged.some(pr => Date.parse(pr.mergedAt) > Date.parse(now)))
+            return false;
+        const staged = new Map();
+        this.stageArchive(staged, family[0], true);
+        staged.get(snapshot.rootId).autoArchive = { reason: 'pull-requests-merged', archivedAt: now, fingerprint: current.fingerprint, pullRequests: merged };
+        this.commitIndex(staged);
+        for (const id of staged.keys())
+            this.compressor.enqueue(id);
+        return true;
+    }
+    setArchived(id, archived) {
+        const run = this.record(id);
+        if (!run)
+            return undefined;
+        this.applyArchivedCascade(run, archived);
+        return run;
+    }
+    /** Parent + owned workers; returns how many records flipped `archived`. */
+    applyArchivedCascade(run, archived) {
+        const staged = new Map();
+        this.stageArchive(staged, run, archived);
+        let changed = 0;
+        for (const [id, next] of staged) {
+            if (next && this.peek(id)?.archived !== archived)
+                changed++;
+            if (next)
+                next.completionAction = undefined; // an explicit filing/restoration retires pending work
+        }
+        this.commitIndex(staged);
+        return changed;
+    }
+    applyArchived(run, archived) {
+        const changed = run.archived !== archived;
+        // Transcript first: a restore throw aborts with the record unchanged (#818 S3).
+        this.syncTranscriptForm(run.id, archived);
+        archiveFields(run, archived, new Date().toISOString());
+        this.touch(run);
+        return changed;
+    }
+    /** Transcript form follows `archived`: enqueue compression, or restore the plain file now. */
+    syncTranscriptForm(id, archived) {
+        if (archived)
+            this.compressor.enqueue(id);
+        else {
+            this.compressor.cancel(id);
+            restoreHistory(this.dataDir, id);
+        }
+    }
+    /**
+     * Whether this store may compress `id`'s transcript: the run exists, is archived, is not in a
+     * live status (queued/running/waiting), and this process holds the family's claim in `claimed`
+     * (not merely `pendingClaims`). Two processes never both write a run (#779, #818 B1).
+     */
+    isHistoryCompressEligible(id) {
+        if (this.deleted.has(id))
+            return false;
+        try {
+            const run = this.held.get(id) ?? this.peek(id);
+            if (!run || run.archived !== true || isLiveStatus(run.status))
+                return false;
+            return this.holdsCompressClaim(id);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Take the family claim if free and require it to be in `this.claimed`, not only pending. */
+    holdsCompressClaim(id) {
+        const family = this.familyOf(id);
+        return this.claimFamilies([family]).has(family) && this.claimed.has(family);
+    }
+    /** Startup sweep: enqueue every archived non-live run that still has a plain transcript. */
+    compressArchivedHistory() {
+        try {
+            const ids = new Set();
+            for (const key of this.db?.listKeysWhere('archived = 1 AND live = 0') ?? []) {
+                if (!this.deleted.has(key.id))
+                    ids.add(key.id);
+            }
+            for (const run of this.held.values()) {
+                if (run.archived && !isLiveStatus(run.status) && !this.deleted.has(run.id))
+                    ids.add(run.id);
+            }
+            for (const id of ids) {
+                try {
+                    const { plain } = historyPaths(this.dataDir, id);
+                    // Claim only ids with work: a plain file to compress, including both-present leftovers.
+                    if (!existsSync(plain))
+                        continue;
+                    if (!this.holdsCompressClaim(id))
+                        continue;
+                    if (hasPlainHistory(this.dataDir, id))
+                        this.compressor.enqueue(id);
+                }
+                catch {
+                    // Best effort: one id must not stop the sweep or boot (#818 S2).
+                }
+            }
+        }
+        catch {
+            // listKeysWhere / open-time fs: never throw out of boot.
+        }
+    }
+    /** Resolves when the transcript compressor is idle (tests, shutdown). */
+    historyIdle() {
+        return this.compressor.idle();
+    }
+    /** Pin one run to the top of this project's task list, or unpin it (#935). Mirrors
+     *  `setArchived`: sets the fields, then persists + broadcasts via `touch`, so the updated
+     *  record rides the existing `run` SSE with no new event. Idempotent — re-pinning a pinned
+     *  run just re-stamps `pinnedAt`.
+     *
+     *  Every active status is pinnable. Archived requests clear stale metadata instead, so a
+     *  late click racing archive cannot leave a hidden pin that reappears on unarchive. */
+    setPinned(id, pinned) {
+        const run = this.record(id);
+        if (!run)
+            return undefined;
+        if (pinned && !run.archived) {
+            run.pinned = true;
+            run.pinnedAt = new Date().toISOString();
+        }
+        else {
+            clearPin(run);
+        }
+        this.touch(run);
+        return run;
+    }
+    /** Bulk-archive finished runs (#780). `isSweepable` decides which; `archived` counts every
+     *  record that flipped (cascaded workers included), `ids` lists the top-level runs picked and
+     *  `pinnedIds` the subset that carried a pin before `clearPin` dropped it. */
+    archiveFinished(scope, automation) {
+        let archived = 0;
+        // Snapshot first: cascade may archive still-live workers, mutating the held set, and the pin
+        // has to be read before `applyArchived` clears it. Runs not in memory are picked off their
+        // stored summary, which carries every field `isSweepable` reads.
+        const picked = [...this.held.values()].filter((run) => SWEEPABLE_RUN_RULE.matches({ ...run, automationId: automationIdOf(run) }, scope, automation))
+            .map((run) => [run, this.listOrder(run)]);
+        for (const row of this.db?.listWhere(SWEEPABLE_RUN_RULE.sql) ?? []) {
+            if (this.held.has(row.id) || this.deleted.has(row.id))
+                continue;
+            const summary = parseStoredSummary(row.summary);
+            if (summary && SWEEPABLE_RUN_RULE.matches(summary, scope, automation))
+                picked.push([summary, row]);
+        }
+        // Another process's runs are not this store's to archive (#779, plan step 3): they stay out.
+        // A sweepable run is never a worker (`isSweepable`), so each is its own family.
+        const writable = this.claimFamilies(picked.map(([run]) => run.id));
+        const mine = sortNewestFirst(picked.filter(([run]) => writable.has(run.id)));
+        const ids = mine.map((run) => run.id);
+        const pinnedIds = mine.filter((run) => run.pinned).map((run) => run.id);
+        for (const id of ids) {
+            // Re-check: a prior cascade may already have archived this id.
+            const run = this.record(id);
+            if (!run || run.archived)
+                continue;
+            archived += this.applyArchivedCascade(run, true);
+        }
+        return { archived, ids, pinnedIds };
+    }
+    /** Mark one run as read (#unread-done-items): stamp the read receipt now. Mirrors
+     *  `setArchived` — sets the field then persists + broadcasts via `touch`, so the
+     *  updated record rides the existing `run` SSE with no new event. Idempotent by
+     *  design: opening an already-read thread just re-stamps a later `seenAt`. */
+    setRead(id) {
+        const run = this.record(id);
+        if (!run)
+            return undefined;
+        run.seenAt = new Date().toISOString();
+        this.touch(run);
+        return run;
+    }
+    /** Mark one run as UNread (#775): drop the read receipt so the run rejoins the unread
+     *  list. The inverse of `setRead` and, like it, `touch`es so the updated record rides the
+     *  existing `run` SSE.
+     *
+     *  Deleting the field rather than adding a "manually unread" flag is the whole point:
+     *  absent `seenAt` is ALREADY what every reader treats as unread (`isUnread` in the
+     *  cockpit's read-state.ts, and `markAllRead`'s clause-for-clause copy of it below), so
+     *  clearing needs no new state and writes a shape any older cezar already parses.
+     *
+     *  Deliberately unconditional: clearing a receipt is always a legal write, so this
+     *  succeeds for an already-unread run (idempotent) and for statuses that can never wear
+     *  the marker. WHETHER the action means anything for a given run is UI policy, and lives
+     *  in the cockpit's `runActionFlags` — the same split the rest of the store keeps. */
+    setUnread(id) {
+        const run = this.record(id);
+        if (!run)
+            return undefined;
+        delete run.seenAt;
+        this.touch(run);
+        return run;
+    }
+    /**
+     * Stamp unread finished runs in bulk and return the count. Keep the rule aligned with cockpit
+     * isUnread: done/failed, finished since seen, not archived; cancelled and usage-limit waiting
+     * runs are excluded. `automation` narrows it to one origin, as in `archiveFinished`
+     * (hearsay-tools/cezarion#1616); absent stamps both.
+     */
+    markAllRead(automation) {
+        const now = new Date().toISOString();
+        let count = 0;
+        // Runs not in memory are picked by the same rule over their stored summary, then re-checked
+        // on the record before they are stamped.
+        const candidates = [...this.held.values()];
+        const stored = (this.db?.listWhere(UNREAD_RUN_RULE.sql) ?? []).filter((row) => !this.held.has(row.id) && !this.deleted.has(row.id));
+        // One claim transaction for them all; another process's runs are skipped (`record` refuses).
+        this.claimFamilies(stored.map(rowFamily));
+        for (const row of stored) {
+            const run = this.record(row.id);
+            if (run)
+                candidates.push(run);
+        }
+        for (const run of candidates) {
+            const unread = UNREAD_RUN_RULE.matches(run);
+            if (!unread)
+                continue;
+            if (automation !== undefined && (automationIdOf(run) !== undefined) !== automation)
+                continue;
+            run.seenAt = now;
+            this.touch(run);
+            count++;
+        }
+        return count;
+    }
+    appendEvent(runId, event) {
+        const run = this.record(runId);
+        if (!run) {
+            const ownership = this.runOwnership(runId);
+            if (ownership === 'fallback')
+                throw this.fallbackRefusal(runId);
+            if (ownership === 'foreign' || ownership === 'orphaned' || ownership === 'quarantined')
+                throw new RunWriteRefusedError(runId, ownership);
+            throw new Error(`unknown run: ${runId}`);
+        }
+        const seq = this.nextSeq(runId);
+        // Scrub credentials before the event touches disk or the live wire (#427):
+        // tool-result output is persisted verbatim and served back over the API, so
+        // a secret in an agent's command output would otherwise land in `.ai/cezar/`.
+        const full = this.redact(defined({ ...event, seq, ts: new Date().toISOString() }));
+        // Sync append keeps event order without a write queue; local NDJSON
+        // appends at agent-event rates are effectively free.
+        if (!hasPlainHistory(this.dataDir, runId))
+            restoreHistory(this.dataDir, runId);
+        const line = `${JSON.stringify(full)}\n`;
+        appendFileSync(this.eventsPath(runId), line, 'utf8');
+        this.facts.append(runId, full, Buffer.byteLength(line));
+        this.maybeEnqueueHistoryCompress(run);
+        this.liveItems.observe(runId, full, false);
+        this.emit('event', { runId, event: full });
+        // Reference discovery runs last, after the event is persisted, indexed and
+        // published: the janitor reads the event text and may still update the run.
+        scanEventReferences(run, full, this.repoHandle, (target, entries) => this.accumulatePullRequests(target, entries), (target) => this.touch(target));
+        return full;
+    }
+    /**
+     * Apply agent-declared reference markers (spec 2026-07-18-task-ref-markers).
+     * Marker values are authoritative for the display tier: they overwrite the
+     * regex/namer numbers unless the prompt identifies the originating issue, and a declared PR re-resolves the referenced URL
+     * against the candidate working set — including down to `undefined` when no
+     * candidate matches (a wrong chip is worse than no chip). The created tier
+     * (`pullRequestUrl`) is deliberately untouched.
+     *
+     * One declaration is NOT a statement about the referenced tier: the number of the PR this run
+     * itself created. See `referencedPrDeclaration` — the marker contract asks the agent to
+     * re-declare after it opens a PR, and taking that literally cost the task the PR it was about.
+     */
+    applyMarkerRefs(runId, refs) {
+        const run = this.record(runId);
+        if (!run || (refs.pr === undefined && refs.issue === undefined))
+            return run;
+        const numbers = [...new Set([...(run.markerRefs?.pr === undefined ? [] : [run.markerRefs.pr]),
+                ...(refs.prs ?? (refs.pr === undefined ? [] : [refs.pr]))])];
+        if (numbers.length)
+            this.accumulatePullRequests(run, numbers.flatMap((number) => {
+                const matches = (run.referencedPrCandidates ?? []).filter((url) => refUrlNumber(url) === number &&
+                    (this.repoHandle ? isRepoScopedRef(url, run.task, this.repoHandle) : promptNamesRepo(url, run.task)));
+                const url = matches.length === 1 ? matches[0] : matches.length === 0 && this.repoHandle
+                    ? `https://github.com/${this.repoHandle.owner}/${this.repoHandle.name}/pull/${number}` : undefined;
+                const parsed = runPullRequestSchema.safeParse({ number, ...(url ? { url } : {}), source: 'declared' });
+                return parsed.success ? [parsed.data] : [];
+            }));
+        run.markerRefs = {
+            ...run.markerRefs,
+            ...(refs.pr !== undefined ? { pr: refs.pr } : {}),
+            ...(refs.issue !== undefined ? { issue: refs.issue } : {}),
+        };
+        // `prNumber` is the about-PR as well (it is what paints a numeric-only chip), so a
+        // re-declaration naming the created PR only FILLS it — it never overwrites the number the
+        // task came in with, which is still the PR this task is about.
+        if (refs.pr !== undefined && (run.prNumber === undefined || refs.pr !== refUrlNumber(run.pullRequestUrl))) {
+            run.prNumber = refs.pr;
+        }
+        if (refs.issue !== undefined) {
+            run.issueNumber = originatingIssue(run) ?? refs.issue;
+            delete run.referencedIssueNumberSeeded;
+        }
+        if (run.markerRefs.pr !== undefined) {
+            run.referencedPullRequestUrl = resolveReferencedRef(run.referencedPrCandidates ?? [], run.task, referencedPrDeclaration(run), this.repoHandle);
+        }
+        if (run.markerRefs.issue !== undefined) {
+            run.referencedIssueUrl = resolveIssueReference(run, this.repoHandle);
+        }
+        this.touch(run);
+        return run;
+    }
+    /** Authoritative creation keeps the first scalar for publishing, plus every created identity. */
+    recordCreatedPr(runId, url) {
+        const run = this.record(runId);
+        const parsed = runPullRequestSchema.safeParse({ number: refUrlNumber(url), url, source: 'created' });
+        if (!run || !parsed.success)
+            return run;
+        let changed = this.accumulatePullRequests(run, [parsed.data]);
+        if (!run.pullRequestUrl) {
+            run.pullRequestUrl = url;
+            changed = true;
+        }
+        if (changed)
+            this.touch(run);
+        return run;
+    }
+    accumulatePullRequests(run, entries) {
+        return stagePullRequests(run, entries, this.repoHandle);
+    }
+    /**
+     * Fan an event out to live subscribers WITHOUT writing it to the NDJSON
+     * file — the channel for coalesced `item.delta` flushes (protocol-v2
+     * performance guardrail: raw deltas never hit disk; replay = the persisted
+     * snapshots). Stamped with `seq`/`ts` like persisted lines so the live
+     * wire keeps one ordering axis. Finite polling coalesces active item content
+     * into bounded in-memory snapshots on that clock; disk replay still has gaps
+     * (dedup compares with `>`).
+     */
+    emitEphemeral(runId, event) {
+        const full = this.redact({ ...event, seq: this.nextSeq(runId), ts: new Date().toISOString() });
+        this.liveItems.observe(runId, full, true);
+        this.emit('event', { runId, event: full });
+        return full;
+    }
+    /** Lazily-collected concrete secret values from the host env (#427). */
+    secretValues = null;
+    /** Controller-issued tokens never persist, including when host-secret redaction is disabled. */
+    sessionSecrets = new Set();
+    registerSessionSecret(value) { this.sessionSecrets.add(value); }
+    containsSessionSecret(value) { return [...this.sessionSecrets].some(secret => value.includes(secret)); }
+    /**
+     * Scrub known credential values / token shapes from an event before it is
+     * persisted or fanned out. On by default; `CEZ_REDACT_SECRETS=0` opts out.
+     */
+    redact(event) {
+        const safe = this.sessionSecrets.size ? redactDeep(event, [...this.sessionSecrets]) : event;
+        if (productEnv('REDACT_SECRETS') === '0')
+            return safe;
+        return redactDeep(safe, this.hostSecrets());
+    }
+    /** Best-effort scrub of one free-text string bound for `runs.json`. Honors
+     *  the `CEZ_REDACT_SECRETS=0` opt-out itself so every caller inherits it. */
+    redactText(text) {
+        return redactText(text, [...this.sessionSecrets], () => this.hostSecrets());
+    }
+    hostSecrets() {
+        if (this.secretValues === null)
+            this.secretValues = collectSecretValues();
+        return this.secretValues;
+    }
+    /** The run's indexed transcript facts (#880): a read-only view, never a transcript read once
+     *  the run's index is loaded. An unreadable transcript answers as empty, as readEvents does. */
+    transcriptFacts(runId) {
+        return this.factsFor(runId).get(runId) ?? emptyFacts();
+    }
+    /** The run's transcript facts when they are known: undefined when the transcript exists but its
+     *  facts are not current or cannot be read, so a caller can tell "no ask" from "no evidence". */
+    knownTranscriptFacts(runId) {
+        return this.factsFor(runId).peek(runId);
+    }
+    hasProjection(runId, projectionId) {
+        return this.transcriptFacts(runId).projectionIds.includes(projectionId);
+    }
+    factsWarming = Promise.resolve();
+    /** Indexed family enumeration, including members not yet flushed to SQLite. */
+    listFamilyRunIds(rootId) {
+        const ids = new Set([rootId, ...(this.db?.listIdsByParent(rootId) ?? [])]);
+        for (const [id, run] of this.held) {
+            if (familyRootOf(run) === rootId)
+                ids.add(id);
+            else if (id !== rootId)
+                ids.delete(id);
+        }
+        for (const id of this.deleted)
+            ids.delete(id);
+        return [...ids];
+    }
+    recoveryFactIds(familyRootId) {
+        if (familyRootId !== undefined)
+            return this.listFamilyRunIds(familyRootId);
+        const ids = new Set();
+        for (const [id, run] of this.held) {
+            if (!isLiveRecord(run))
+                continue;
+            const root = familyRootOf(run);
+            for (const member of root === undefined ? [id] : this.listFamilyRunIds(root))
+                ids.add(member);
+        }
+        return [...ids];
+    }
+    /** Readiness owns no run snapshot across an await: refresh only the currently held owner. */
+    async prepareTranscriptFacts(runIds) {
+        for (const id of new Set(runIds)) {
+            // Exact sidecars resolve immediately too: recovery must yield to timers/I/O between IDs.
+            await new Promise(resolve => setImmediate(resolve));
+            await this.factsFor(id).ready(id);
+        }
+    }
+    prepareRecoveryFacts(familyRootId) {
+        return this.prepareTranscriptFacts(this.recoveryFactIds(familyRootId));
+    }
+    /** Register IDs only here; the index yields between cache reads and off-loop rebuilds. */
+    warmTranscriptFacts() {
+        this.factsWarming = Promise.resolve().then(async () => {
+            if (!this.db)
+                return;
+            const ids = new Set(this.recoveryFactIds());
+            // hearsay-tools/cezarion#949: this microtask ends open()'s synchronous slice, and on a
+            // large history the JSON scan for conversation roots plus one family query per root cost
+            // as much again. Past one slice's worth of runs, yield before the scan and between root
+            // batches; a small store (every unit test) still registers in this one microtask.
+            const large = this.listRunIds().length > WARM_IDS_PER_SLICE;
+            const turn = async () => {
+                await new Promise(resolve => setImmediate(resolve));
+                return this.db !== null;
+            };
+            if (large && !await turn())
+                return;
+            const roots = this.listConversationRootIds();
+            for (let i = 0; i < roots.length; i++) {
+                if (large && i > 0 && i % WARM_IDS_PER_SLICE === 0 && !await turn())
+                    return;
+                for (const id of this.listFamilyRunIds(roots[i]))
+                    ids.add(id);
+            }
+            if (large && !await turn())
+                return;
+            // Re-list after the yields: a run deleted meanwhile must not be registered again.
+            const present = this.listRunIds();
+            if (large) {
+                const live = new Set(present);
+                for (const id of ids)
+                    if (!live.has(id))
+                        ids.delete(id);
+            }
+            for (const id of present)
+                ids.add(id);
+            await this.facts.warm(ids);
+        }).catch(() => undefined);
+    }
+    /** Resolves when the open-time warm-up is done (tests). */
+    factsWarmIdle() {
+        return this.factsWarming;
+    }
+    /** `readEvents` off the event loop (async read and async brotli), for collection paths. */
+    async readEventsAsync(runId) {
+        try {
+            const raw = await readHistoryTextAsync(this.sourceDataDir(runId), runId);
+            return raw === undefined ? [] : parseEvents(raw);
+        }
+        catch {
+            return [];
+        }
+    }
+    readEvents(runId) {
+        try {
+            const raw = readHistoryText(this.sourceDataDir(runId), runId);
+            if (raw === undefined)
+                return [];
+            return parseEvents(raw);
+        }
+        catch {
+            return [];
+        }
+    }
+    /** Private process-generation evidence; never part of run JSON or SSE. */
+    identityPath(id, write = false) {
+        return this.executionPath(id, write).replace(/\.execution\.json$/, '.identity.json');
+    }
+    readWorkerIdentity(id) {
+        try {
+            const fd = openSync(this.identityPath(id), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+            try {
+                const info = fstatSync(fd);
+                if (!info.isFile() || info.size > 16384 || (info.mode & 0o077))
+                    return undefined;
+                const buffer = Buffer.alloc(16385);
+                const count = readSync(fd, buffer, 0, buffer.length, 0);
+                return workerExecutionIdentitySchema.parse(JSON.parse(buffer.subarray(0, count).toString('utf8')));
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        catch {
+            return undefined;
+        }
+    }
+    writeWorkerIdentity(id, identity) {
+        // Immutable acceptance evidence. An orphan from failed index publication cannot be adopted.
+        const fd = openSync(this.identityPath(id, true), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        try {
+            writeFileSync(fd, JSON.stringify(identity));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    executionPath(id, write = false) {
+        z.string().uuid().parse(id);
+        const dir = join(write ? this.writeDir(id) : this.sourceDataDir(id), 'runs');
+        if (write)
+            mkdirSync(dir, { recursive: true });
+        if (lstatSync(dir).isSymbolicLink() || realpathSync(dir) !== resolve(dir))
+            throw new Error('Unsafe execution directory');
+        return join(dir, `${id}.execution.json`);
+    }
+    readWorkerExecution(id) {
+        try {
+            const path = this.executionPath(id);
+            const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+            try {
+                const info = fstatSync(fd);
+                if (!info.isFile() || info.size > 16384 || (info.mode & 0o077))
+                    return undefined;
+                const buffer = Buffer.alloc(16385);
+                const count = readSync(fd, buffer, 0, buffer.length, 0);
+                return workerExecutionSchema.parse(JSON.parse(buffer.subarray(0, count).toString('utf8')));
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        catch {
+            return undefined;
+        }
+    }
+    writeWorkerExecution(id, proof, fresh = false) {
+        const path = this.executionPath(id, true);
+        try {
+            const existing = lstatSync(path);
+            if (fresh || !existing.isFile() || existing.isSymbolicLink())
+                throw new Error('Unsafe execution checkpoint');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        const temporary = `${path}.${randomUUID()}.tmp`;
+        const fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        try {
+            writeFileSync(fd, JSON.stringify(proof));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        try {
+            renameSync(temporary, path);
+        }
+        finally {
+            rmSync(temporary, { force: true });
+        }
+    }
+    /** Complete execution is not permission to reuse/delete persistent resources (#738).
+     * Synchronous, fresh and generation/resource fenced; callers hold admission off across awaits. */
+    workerResourcesSafe(id, generation, resourceId, admittingQueued = false) {
+        return this.workerResourceHolders(id, generation, resourceId, { admittingQueued }) === 'safe';
+    }
+    /** `workerResourcesSafe` with the refusal's live PIDs (empty when no PID explains it). */
+    workerResourceHolders(id, generation, resourceId, opts = {}) {
+        if (autosaveCleanupBlocker(this.dataDir, id))
+            return [];
+        const run = this.peek(id);
+        const proof = this.readWorkerExecution(id);
+        if (!workerResourceAuthorized(run, proof, id, generation, resourceId, opts.admittingQueued))
+            return [];
+        const record = this.readWorkerProcesses(id, generation);
+        if (record === 'unknown' || !agentTmpDirOwnershipProven(this.dataDir, id))
+            return [];
+        const paths = [run.delegation.workspace.path, ...agentTmpDirLocations(this.dataDir, id)];
+        // Nothing can be deleted/reused at an absent path. This lets explicit history deletion
+        // retire completed cleanup despite ambient denial, while recorded survivors/unknown evidence
+        // still block. Only ENOENT proves absence; existsSync would also hide access errors.
+        if (workerResourcePathsGone(paths))
+            return workerResourceAbsentHolders(record);
+        return workerResourceLiveHolders(inspectGeneration({ ...(record === 'absent' ? {} : { record }), paths, cwds: opts.cwds }));
+    }
+    /** Upgrade a legacy completed checkpoint while terminal task ownership is still known.
+     * No holder scan here: settlement and scheduling must never wait on cleanup proof. */
+    retainWorkerScratchCleanup(id) {
+        const run = this.peek(id), proof = this.readWorkerExecution(id);
+        if (run?.delegation?.role !== 'worker' || ['queued', 'running', 'waiting'].includes(run.status) || proof?.phase !== 'complete')
+            return;
+        const { resourceId, path } = run.delegation.workspace;
+        if (proof.scratchCleanup?.resourceId === resourceId && proof.scratchCleanup.path === path)
+            return;
+        this.writeWorkerExecution(id, { ...proof, scratchCleanup: { resourceId, path } });
+    }
+    /** Cleanup can outlive its index row, but never its generation or terminal task intent.
+     * `cwds` is the scratch reprobe tick's shared `/proc` snapshot (hearsay-tools/cezarion#879). */
+    workerScratchResourcesSafe(id, generation, resourceId, cwds) {
+        if (autosaveCleanupBlocker(this.dataDir, id))
+            return false;
+        const run = this.peek(id), proof = this.readWorkerExecution(id);
+        if (proof?.phase !== 'complete' || proof.generation !== generation || proof.scratchCleanup?.resourceId !== resourceId ||
+            (run && ['queued', 'running', 'waiting'].includes(run.status)))
+            return false;
+        if (run?.delegation?.role === 'worker')
+            return run.delegation.workspace.path === proof.scratchCleanup.path &&
+                this.workerResourceHolders(id, generation, resourceId, { cwds }) === 'safe';
+        // A valid different role contradicts the retained intent. Quarantined/missing metadata
+        // supplies no new authority; only the private terminal checkpoint authorizes scratch.
+        if (run && run.delegation?.role !== 'invalid')
+            return false;
+        const record = this.readWorkerProcesses(id, generation);
+        if (record === 'unknown' || !agentTmpDirOwnershipProven(this.dataDir, id))
+            return false;
+        return inspectGeneration({ ...(record === 'absent' ? {} : { record }),
+            paths: [proof.scratchCleanup.path, ...agentTmpDirLocations(this.dataDir, id)], cwds }).liveness === 'gone';
+    }
+    commitWorkerExecutionStart(id) {
+        const run = this.peek(id);
+        if (run?.delegation?.role !== 'worker' || run.delegation.destroy)
+            throw new Error('Worker cannot start');
+        const prior = this.readWorkerExecution(id);
+        if (prior?.abandoned)
+            throw new Error('Worker execution was abandoned; spawn a new worker instead of resuming it');
+        if (!prior || (prior.phase !== 'queued' && prior.phase !== 'complete')) {
+            throw new Error('Worker execution checkpoint does not prove safe admission');
+        }
+        if (!this.workerResourcesSafe(id, prior.generation, run.delegation.workspace.resourceId, true)) {
+            throw new Error('Worker resources may still be held by a process; reuse is not proven safe');
+        }
+        const generation = randomUUID();
+        // #469: the controller is durable before `starting`, so a crash leaves a provable generation.
+        this.writeWorkerProcesses(id, { generation, controller: { pid: process.pid, ...startToken(process.pid) }, processes: [] });
+        this.writeWorkerExecution(id, { generation, phase: 'starting' });
+        return generation;
+    }
+    /** Private process record (#469): which processes a generation spawned, never part of run JSON or SSE. */
+    processesPath(id, write = false) {
+        return this.executionPath(id, write).replace(/\.execution\.json$/, '.processes.json');
+    }
+    /** Tri-state: only ENOENT is `absent` (legacy, scan-only). A present record that is unreadable,
+     * wrongly permissioned, malformed or of another generation is `unknown`: never finalized or reaped. */
+    readWorkerProcesses(id, generation) {
+        try {
+            const fd = openSync(this.processesPath(id), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+            try {
+                const info = fstatSync(fd);
+                if (!info.isFile() || info.size > 8192 || (info.mode & 0o077))
+                    return 'unknown';
+                const buffer = Buffer.alloc(8193);
+                const count = readSync(fd, buffer, 0, buffer.length, 0);
+                const record = workerProcessRecordSchema.parse(JSON.parse(buffer.subarray(0, count).toString('utf8')));
+                return record.generation === generation ? record : 'unknown';
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        catch (error) {
+            return error.code === 'ENOENT' ? 'absent' : 'unknown';
+        }
+    }
+    writeWorkerProcesses(id, record) {
+        const path = this.processesPath(id, true);
+        try {
+            const existing = lstatSync(path);
+            if (!existing.isFile() || existing.isSymbolicLink())
+                throw new Error('Unsafe process record');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        const temporary = `${path}.${randomUUID()}.tmp`;
+        const fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        try {
+            writeFileSync(fd, JSON.stringify(workerProcessRecordSchema.parse(record)));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        try {
+            renameSync(temporary, path);
+        }
+        finally {
+            rmSync(temporary, { force: true });
+        }
+    }
+    /** Bound to the current generation. Past the cap the record never drops an entry: the
+     * working-directory scan is the remaining evidence. */
+    appendWorkerProcess(id, generation, pid, pgid) {
+        const record = this.readWorkerProcesses(id, generation);
+        if (typeof record === 'string' || this.readWorkerExecution(id)?.generation !== generation)
+            return false;
+        const entry = { pid, ...startToken(pid), ...(pgid === undefined ? {} : { pgid }) };
+        if (record.processes.some(known => known.pid === entry.pid && known.startToken === entry.startToken))
+            return true;
+        if (record.processes.length >= WORKER_PROCESS_CAP)
+            return false;
+        this.writeWorkerProcesses(id, { ...record, processes: [...record.processes, entry] });
+        return true;
+    }
+    commitWorkerExecutionComplete(id, generation) {
+        const proof = this.readWorkerExecution(id);
+        if (!proof || proof.generation !== generation)
+            return false;
+        if (proof.phase === 'queued' && this.peek(id)?.status !== 'cancelled')
+            return false;
+        try {
+            const run = this.peek(id);
+            if (run?.delegation?.role !== 'worker')
+                return false;
+            this.commitIndex(new Map([[id, run]]));
+            if (this.readWorkerExecution(id)?.generation !== generation)
+                return false;
+            this.writeWorkerExecution(id, { generation, phase: 'complete',
+                // Nothing abandons an execution any more (hearsay-tools/cezarion#889); keep a checkpoint that already was.
+                ...(proof.abandoned ? { abandoned: true } : {}),
+                ...(proof.phase === 'queued' || proof.neverMaterialized ? { neverMaterialized: true } : {}),
+                ...(!['queued', 'running', 'waiting'].includes(run.status) ? { scratchCleanup: {
+                        resourceId: run.delegation.workspace.resourceId, path: run.delegation.workspace.path
+                    } } : {}) });
+            // The earlier index event cannot attest exit: subscribers must observe the
+            // durable private proof before a terminal worker can satisfy a lifecycle wait.
+            this.emit('run', this.peek(id));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Complete replacement evidence can stand in for absent child history, never for a present execution. */
+    readDeletedWorkerResult(parentId, workerId) {
+        if (this.hasRun(workerId))
+            return undefined;
+        const parent = this.peek(parentId);
+        if (parent?.delegation?.role !== 'root' || parent.delegation.historyDeletion)
+            return undefined;
+        const deletion = parent.delegation.receipts.find(receipt => receipt.workerId === workerId)?.deletion;
+        if (deletion?.phase !== 'complete')
+            return undefined;
+        const result = this.readWorkerResult(parentId, workerId);
+        return result?.settled && ['review', 'done', 'failed', 'cancelled'].includes(result.status) &&
+            result.cleanup === 'complete' && result.revision === deletion.revision &&
+            result.workspace.resourceId === deletion.resourceId ? result : undefined;
+    }
+    /** A deleted child's receipt replaces the private proof only after the deletion checkpoint. */
+    workerDeletionEvidence(id) {
+        const child = this.peek(id);
+        if (child?.delegation?.role !== 'worker' || child.delegation.workspace.ownerRunId !== id ||
+            child.delegation.destroy?.phase !== 'complete' || child.delegation.destroy.remaining.length ||
+            !['review', 'done', 'failed', 'cancelled'].includes(child.status))
+            return false;
+        return this.workerDeletionResult(id, child);
+    }
+    workerDeletionResult(id, child) {
+        const parent = this.peek(child.delegation.parentRunId);
+        if (parent?.delegation?.role !== 'root' || parent.delegation.historyDeletion)
+            return false;
+        const receipt = parent.delegation.receipts.find(entry => entry.workerId === id);
+        const result = this.readWorkerResult(parent.id, id);
+        if (!receipt || !result?.settled || result.cleanup !== 'complete' || result.status !== child.status ||
+            result.revision !== (child.delegation.executionRevision ?? 0))
+            return false;
+        const { state: _state, ...workspace } = result.workspace;
+        if (JSON.stringify(workspace) !== JSON.stringify(child.delegation.workspace))
+            return false;
+        return workerDeletionProof(receipt.deletion, result.revision, workspace.resourceId, {
+            readProof: () => this.readWorkerExecution(id), resourcesSafe: generation => this.workerResourcesSafe(id, generation, workspace.resourceId),
+            scratchMayExist: () => agentTmpDirMayExist(this.dataDir, id), executionExists: () => existsSync(this.executionPath(id)),
+        });
+    }
+    canDeleteRun(id, kind = 'record') {
+        if (this.fallbackDeleteError(id, kind))
+            return false;
+        if (autosaveCleanupBlocker(this.dataDir, id))
+            return false;
+        const run = this.peek(id);
+        if (run?.delegation?.role === 'invalid')
+            return false;
+        if (run?.delegation?.role === 'worker')
+            return this.workerDeletionEvidence(id);
+        const privateWorkers = workerEvidenceRunIds(this.dataDir);
+        if (!privateWorkers || privateWorkers.includes(id))
+            return false;
+        if (run?.delegation?.role === 'root') {
+            if (run.delegation.finishRequestedAt && ['queued', 'running', 'waiting'].includes(run.status))
+                return false;
+            // Keep the parent's receipt and result ownership until each child history is explicitly removed.
+            if (this.listWorkersOf(id).length > 0)
+                return false;
+            return run.delegation.receipts.every(receipt => {
+                if (this.hasRun(receipt.workerId) || receipt.deletion?.phase !== 'complete')
+                    return false;
+                // A pending parent deletion already validated the results before removing their bytes.
+                if (run.delegation?.role === 'root' && run.delegation.historyDeletion === 'pending')
+                    return true;
+                return this.readDeletedWorkerResult(id, receipt.workerId) !== undefined;
+            });
+        }
+        return this.listWorkersOf(id).length === 0;
+    }
+    /** Delegated history deletion is synchronous and checkpointed; any failed byte/index removal remains retryable. */
+    deleteDelegatedRun(id) {
+        const run = this.peek(id);
+        try {
+            if (run.delegation?.role === 'worker') {
+                const parent = this.peek(run.delegation.parentRunId);
+                if (parent.delegation?.role !== 'root')
+                    return false;
+                const receipt = parent.delegation.receipts.find(entry => entry.workerId === id);
+                const result = this.readWorkerResult(parent.id, id);
+                const deletion = receipt.deletion ?? { phase: 'pending', revision: result.revision,
+                    resourceId: run.delegation.workspace.resourceId, generation: this.readWorkerExecution(id).generation };
+                this.commitDelegation([{ id: parent.id, delegation: { ...parent.delegation,
+                            receipts: parent.delegation.receipts.map(entry => entry.workerId === id ? { ...entry, deletion } : entry),
+                        } }]);
+                // Do not advertise artifact bytes as retained while interrupted deletion is in progress.
+                this.commitWorkerResult(parent.id, { ...result, observedAt: new Date().toISOString(),
+                    diff: result.diff.state === 'available' ? { ...result.diff, snapshotId: randomUUID() } : result.diff,
+                    artifacts: result.artifacts.state === 'available' ? { ...result.artifacts,
+                        items: result.artifacts.items.map(item => ({ state: 'unavailable', reason: 'unreadable',
+                            detail: 'History deletion is in progress', id: item.id, path: item.path })),
+                    } : result.artifacts,
+                }, this.readWorkerResultDiff(parent.id, id));
+                this.removeRunHistoryBytes(id);
+                // Delete scratch while its generation evidence still exists; failed removal keeps it.
+                removeAgentTmpDir(this.dataDir, id);
+                if (agentTmpDirMayExist(this.dataDir, id))
+                    return false;
+                // Private process/account evidence is now replaced by the exact parent receipt.
+                rmSync(this.identityPath(id), { force: true });
+                rmSync(this.processesPath(id), { force: true });
+                rmSync(this.executionPath(id), { force: true });
+                const retained = this.readWorkerResult(parent.id, id);
+                this.commitWorkerResult(parent.id, { ...retained, observedAt: new Date().toISOString(),
+                    diff: retained.diff.state === 'available' ? { ...retained.diff, snapshotId: randomUUID() } : retained.diff,
+                    artifacts: retained.artifacts.state === 'available' ? { ...retained.artifacts,
+                        items: retained.artifacts.items.map(item => ({ state: 'deleted', reason: 'missing', id: item.id, path: item.path })),
+                    } : retained.artifacts,
+                }, this.readWorkerResultDiff(parent.id, id));
+                this.commitIndex(new Map([[parent.id, { ...parent, delegation: { ...parent.delegation,
+                                receipts: parent.delegation.receipts.map(entry => entry.workerId === id ? { ...entry, deletion: { ...deletion, phase: 'complete' } } : entry),
+                            } }], [id, null]]));
+            }
+            else if (run.delegation?.role === 'root') {
+                this.commitDelegation([{ id, delegation: { ...run.delegation, historyDeletion: 'pending' } }]);
+                this.removeRunHistoryBytes(id);
+                rmSync(join(this.dataDir, 'runs', `${id}-worker-results`), { recursive: true, force: true });
+                this.commitIndex(new Map([[id, null]]));
+            }
+            else
+                return false;
+            removeAgentTmpDir(this.dataDir, id);
+            this.seqs.delete(id);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    removeRunHistoryBytes(id) {
+        // Fixed owned paths only: never follow context descriptors supplied in persisted metadata.
+        z.uuid().parse(id);
+        const dir = join(this.dataDir, 'runs');
+        if (realpathSync(dir) !== resolve(dir))
+            throw new Error('History storage redirected');
+        this.facts.forget(id);
+        removeHistory(this.dataDir, id);
+        rmSync(this.handoffPath(id), { force: true });
+        rmSync(this.imagesDir(id), { recursive: true, force: true });
+        removeArtifacts(this.dataDir, id);
+        clearAutosaveCleanup(this.dataDir, id);
+    }
+    deleteRun(id) {
+        const refusal = this.fallbackDeleteError(id);
+        if (refusal)
+            throw new Error(refusal);
+        if (!this.canDeleteRun(id))
+            return false;
+        const run = this.peek(id);
+        if (run && this.db && (this.quarantined.has(id) || !this.claimFamilies([familyKey(run)]).size))
+            return false;
+        if (run?.delegation?.role === 'worker' || run?.delegation?.role === 'root')
+            return this.deleteDelegatedRun(id);
+        if (run)
+            clearAutosaveCleanup(this.dataDir, id);
+        const existed = run !== undefined;
+        this.held.delete(id);
+        if (existed) {
+            this.markDeleted(id, familyKey(run));
+            removeAgentTmpDir(this.dataDir, id);
+            this.seqs.delete(id);
+            this.scheduleSave();
+            this.emit('deleted', id);
+        }
+        return existed;
+    }
+    /** Write the pending rows out now (used on shutdown). */
+    flush() {
+        if (this.saveTimer) {
+            clearTimeout(this.saveTimer);
+            this.saveTimer = null;
+        }
+        this.saveNow();
+    }
+    // ---- internals -----------------------------------------------------------
+    seqs = new Map();
+    nextSeq(runId) {
+        const next = (this.seqs.get(runId) ?? this.rehydrateSeq(runId)) + 1;
+        this.seqs.set(runId, next);
+        return next;
+    }
+    /** After a restart the in-memory counter is empty while the run's NDJSON file
+     *  keeps the history. Restarting from 1 would collide with the seqs a client
+     *  already replayed — its `seq > maxSeq` dedup then silently drops every
+     *  resumed event, even across a reload (the frozen-transcript symptom class
+     *  of #424). One file read on the first post-restart append per run. */
+    rehydrateSeq(runId) {
+        return this.transcriptFacts(runId).lastSeq;
+    }
+    eventsPath(runId) {
+        return historyPaths(this.sourceDataDir(runId), runId).plain;
+    }
+    /** Same location `handoffPath()` in handoff.ts produces — inlined to keep
+     *  the store free of upward imports. */
+    handoffPath(runId) {
+        return join(this.sourceDataDir(runId), 'runs', `${runId}.handoff.md`);
+    }
+    /** Agent screenshots persisted by the run manager (see persistImage). */
+    imagesDir(runId) {
+        return join(this.sourceDataDir(runId), 'runs', `${runId}-images`);
+    }
+    touch(run) {
+        this.dirty.add(run.id);
+        this.scheduleSave();
+        this.emit('run', run);
+        this.maybeEnqueueHistoryCompress(run);
+    }
+    /** Form follows archived: a terminal archived run with a plain transcript is queued again. */
+    maybeEnqueueHistoryCompress(run) {
+        if (run.archived && !isLiveStatus(run.status) && hasPlainHistory(this.dataDir, run.id)) {
+            this.compressor.enqueue(run.id);
+        }
+    }
+    /** The held record is gone; the next save or commit deletes its row, fenced by `family`'s claim
+     *  and by the revision this store last saw (kept in `base` until the delete is written). */
+    markDeleted(id, family) {
+        this.liveItems.forget(id);
+        this.coldReads.forget(id);
+        const read = this.coldBase.get(id);
+        if (!this.base.has(id) && read)
+            this.base.set(id, storedRow(read));
+        this.dirty.delete(id);
+        this.deleted.add(id);
+        this.deletedFamilies.set(id, family);
+        this.historyOwed.add(id);
+    }
+    /** A deleted run's history files, once the delete of its row has committed. Best effort, as
+     *  deletion always was. */
+    removeOwedHistory(id) {
+        if (!this.historyOwed.delete(id))
+            return;
+        try {
+            this.facts.forget(id);
+            removeHistory(this.dataDir, id);
+            rmSync(this.handoffPath(id), { force: true });
+            rmSync(this.imagesDir(id), { recursive: true, force: true });
+            removeArtifacts(this.dataDir, id);
+        }
+        catch { /* best effort */ }
+    }
+    /**
+     * Count-based history retention: of the runs past the newest `MAX_RUNS_KEPT` unarchived ones,
+     * archive each finished run without delegation that is not pinned and whose family this store
+     * can claim. Ranked over the row keys (the `created_at` index, no record decoded) with memory
+     * laid over them, since a run created or archived since the last save has no row yet; the rows
+     * past the cut are then filtered in `runs.db`, so only real candidates decode. Archived runs
+     * are never deleted by retention — only an explicit delete, worker destruction, or history
+     * deletion removes a run.
+     */
+    pruneOldRuns() {
+        const ranked = new Map();
+        for (const key of this.db?.listKeysWhere('archived = ?', [0]) ?? []) {
+            if (!this.held.has(key.id) && !this.deleted.has(key.id))
+                ranked.set(key.id, key);
+        }
+        for (const run of this.held.values())
+            if (!run.archived)
+                ranked.set(run.id, { id: run.id, ...this.listOrder(run) });
+        const overflow = [...ranked.values()].sort(newestFirst).slice(MAX_RUNS_KEPT).map((key) => key.id);
+        if (overflow.length === 0)
+            return;
+        const stale = overflow.flatMap((id) => {
+            const run = this.held.get(id);
+            // Retention must not archive a live task between turns, a pinned run, or a delegation
+            // family whose history is promised until explicit deletion.
+            return run && !this.hasFallbackRun(id) && RETENTION_RUN_RULE.matches(run) ? [id] : [];
+        });
+        const skipped = overflow.filter(id => this.hasFallbackRun(id)).length;
+        if (skipped)
+            console.info(`${logPrefix()} Retention skipped ${skipped} read-only fallback run(s) under ${dataReadDirs(this.dataDir)[1]}.`);
+        const cold = overflow.filter((id) => !this.held.has(id) && !this.hasFallbackRun(id));
+        if (cold.length > 0) {
+            // Another process's runs are its own to keep or archive (#779, plan step 3).
+            const rows = this.db.listWhere(RETENTION_RUN_RULE.sql, [JSON.stringify(cold)]);
+            const writable = this.claimFamilies(rows.map(rowFamily));
+            for (const row of rows)
+                if (writable.has(rowFamily(row)))
+                    stale.push(row.id);
+        }
+        for (const id of stale) {
+            const run = this.record(id);
+            if (!run || run.archived || !RETENTION_RUN_RULE.matches(run))
+                continue;
+            this.applyArchived(run, true);
+            removeAgentTmpDir(this.dataDir, id);
+        }
+    }
+    /** Debounced so token-usage updates don't rewrite a row per event. Nothing to schedule without
+     *  a database: a `RunStore.unavailable` store, or a closed one, writes nothing. */
+    scheduleSave() {
+        if (this.saveTimer || !this.db)
+            return;
+        this.saveTimer = setTimeout(() => {
+            this.saveTimer = null;
+            this.saveNow();
+        }, 300);
+        this.saveTimer.unref?.();
+    }
+    /** The single database write, so a test can fail it the way a full disk would. */
+    writeIndex(changes) {
+        const transaction = (changes) => { assertProjectWritable(this.dataDir); return this.db.transaction(changes); };
+        return this.persistence ? this.persistence(changes, transaction) : transaction(changes);
+    }
+    /**
+     * Write `staged` plus everything still pending — dirty rows from memory, deletions — in one
+     * transaction, then clear the pending marks. Throws with nothing cleared when it fails.
+     * Never copies or sorts the whole store: the cost is the rows that changed.
+     *
+     * Fenced (#779, plan step 3): the transaction commits only if every family it writes still
+     * carries this store's claim and every row is at the revision this store last saw. Otherwise
+     * nothing is written and `handleConflicts` deals with the rows that changed under it.
+     */
+    persist(staged) {
+        const upserts = [];
+        const deletes = [];
+        const families = new Map();
+        const extras = new Map();
+        const encode = (run) => {
+            const encoded = encodeRawRecord(run, (this.base.get(run.id) ?? this.coldBase.get(run.id))?.extras);
+            extras.set(run.id, encoded.extras);
+            const projected = { ...run };
+            restoreOriginatingIssue(projected);
+            upserts.push({ ...encodeRunRow(run, encoded.data),
+                issueAttributionCurrent: isDeepStrictEqual(projected, run) });
+        };
+        for (const [id, next] of staged) {
+            if (next)
+                encode(next);
+            else
+                deletes.push(id);
+            families.set(id, next ? familyKey(next) : this.familyOf(id));
+        }
+        for (const id of this.dirty) {
+            const run = this.held.get(id);
+            if (!run || staged.has(id))
+                continue;
+            encode(run);
+            families.set(id, familyKey(run));
+        }
+        for (const id of this.deleted) {
+            if (staged.has(id))
+                continue;
+            deletes.push(id);
+            families.set(id, this.familyOf(id));
+        }
+        // A row's insertion order (`seq`) is the order this write inserts it in, and it is where the
+        // run lists among runs created in the same millisecond. Insert new runs in creation order (the
+        // held set's, then staged runs not held yet), whether staged or dirty brought them here.
+        if (upserts.filter((row) => !this.base.has(row.id)).length > 1) {
+            const created = new Map();
+            for (const id of [...this.held.keys(), ...staged.keys()])
+                if (!created.has(id))
+                    created.set(id, created.size);
+            upserts.sort((a, b) => created.get(a.id) - created.get(b.id));
+        }
+        // A held run whose write moved it into a new family (a worker quarantined to `invalid`) takes
+        // that family's claim first; one it cannot take fails the fence below as claim-lost.
+        const moved = [...new Set(families.values())].filter((family) => !this.claimed.has(family) && !this.pendingClaims.has(family));
+        if (moved.length > 0)
+            this.claimFamilies(moved, { allowLive: true });
+        let commit;
+        try {
+            commit = this.writeIndex({ upserts, deletes, ...(this.owner ? { fence: this.fence(families) } : {}) });
+        }
+        catch (error) {
+            if (error instanceof RunConflictError)
+                this.handleConflicts(error, staged);
+            throw error;
+        }
+        for (const [family, generation] of commit.claims) {
+            this.claimed.set(family, generation);
+            this.pendingClaims.delete(family);
+        }
+        for (const row of upserts) {
+            this.base.set(row.id, { revision: commit.revisions.get(row.id), seq: commit.seqs.get(row.id), data: row.data, extras: extras.get(row.id) });
+        }
+        for (const id of deletes) {
+            this.liveItems.forget(id);
+            this.base.delete(id);
+            this.deletedFamilies.delete(id);
+            this.removeOwedHistory(id);
+        }
+        this.dirty.clear();
+        this.deleted.clear();
+        if (this.saveTimer) {
+            clearTimeout(this.saveTimer);
+            this.saveTimer = null;
+        }
+    }
+    /** What a write of these rows (id → family) must still find: this store's claims, at the
+     *  generations it took them, and each row at the revision it last saw (none for a new row). */
+    fence(families) {
+        const claims = new Map();
+        const rows = new Map();
+        for (const [id, family] of families) {
+            const pending = this.pendingClaims.get(family);
+            // Generations start at 1, so an unclaimed family's 0 fails the fence as claim-lost.
+            claims.set(family, pending !== undefined ? { take: pending } : { generation: this.claimed.get(family) ?? 0 });
+            rows.set(id, { revision: (this.base.get(id) ?? this.coldBase.get(id))?.revision ?? null, family });
+        }
+        return { owner: this.owner, claims, rows };
+    }
+    /**
+     * Handle a fenced-write conflict. Save unexpected conflict evidence before clearing pending
+     * state or quarantining the row. If evidence persistence fails, retain pending writes. Other
+     * rows remain writable; stale unclaimed reads only fail their write.
+     */
+    handleConflicts(error, staged) {
+        const unexpected = error.conflicts.filter((conflict) => this.held.has(conflict.id) || this.deleted.has(conflict.id) || this.coldBase.get(conflict.id)?.owned === true);
+        if (unexpected.length === 0 || !this.db || !this.owner)
+            return;
+        const evidence = unexpected.map((conflict) => {
+            const seen = this.base.get(conflict.id) ?? this.coldBase.get(conflict.id);
+            const local = staged.has(conflict.id) ? staged.get(conflict.id) : this.deleted.has(conflict.id) ? null : this.held.get(conflict.id) ?? null;
+            return {
+                runId: conflict.id, reason: conflict.reason,
+                baseRevision: seen?.revision ?? null, baseData: seen?.data ?? null,
+                localData: local === null ? null : JSON.stringify(local), localDeleted: local === null,
+                currentRevision: conflict.current?.revision ?? null, currentData: conflict.current?.data ?? null,
+            };
+        });
+        let seqs;
+        try {
+            seqs = this.db.recordConflicts(this.owner.session, evidence);
+        }
+        catch (evidenceError) {
+            const message = evidenceError instanceof Error ? evidenceError.message : String(evidenceError);
+            console.error(`${logPrefix()} ${RUNS_DB_FILE}: could not record the conflicting write on ${unexpected.map((c) => c.id).join(', ')}; it stays pending: ${message}`);
+            return;
+        }
+        unexpected.forEach((conflict, index) => {
+            const family = this.familyOf(conflict.id);
+            this.liveItems.forget(conflict.id);
+            this.quarantined.add(conflict.id);
+            this.coldReads.forget(conflict.id);
+            this.dirty.delete(conflict.id);
+            this.deleted.delete(conflict.id);
+            this.deletedFamilies.delete(conflict.id);
+            // The delete did not happen, so the history stays with the row.
+            this.historyOwed.delete(conflict.id);
+            if (conflict.reason === 'claim-lost') {
+                this.claimed.delete(family);
+                this.pendingClaims.delete(family);
+            }
+            const decoded = conflict.current ? decodeRunRow(conflict.current.data) : undefined;
+            const current = decoded?.run;
+            if (this.isFallbackRun(conflict.id))
+                this.held.delete(conflict.id);
+            const held = this.held.get(conflict.id);
+            if (current && conflict.current) {
+                // The other writer's record as it stands, normalized only as a live owner's run would be.
+                reconcileLoadedRun(current, { keepLive: true });
+                rescopeRun(current, this.repoHandle);
+                if (held)
+                    replaceRecord(held, current);
+                this.base.set(conflict.id, { revision: conflict.current.revision, seq: conflict.current.seq, data: conflict.current.data, extras: decoded.extras });
+                this.emit('run', held ?? current);
+            }
+            else {
+                this.held.delete(conflict.id);
+                this.base.delete(conflict.id);
+                this.emit('deleted', conflict.id);
+            }
+            console.error(`${logPrefix()} run ${conflict.id} was changed by another writer (${conflict.reason}); this process will not write it again until ${productName('cezar')} restarts. Evidence: ${join(this.dataDir, RUNS_DB_FILE)}, table run_conflicts, seq ${seqs[index]}.`);
+        });
+        this.scheduleSave();
+    }
+    /** Write what is pending, then (unless closing) let every run whose write settled leave memory. */
+    saveNow(evict = true) {
+        if (!this.db || projectWriteRefused(this.dataDir))
+            return;
+        // A second attempt only after a conflict excluded its rows: the unrelated rest goes out at once.
+        for (let attempt = 0; attempt < 2 && (this.dirty.size > 0 || this.deleted.size > 0); attempt++) {
+            const quarantined = this.quarantined.size;
+            try {
+                this.persist(new Map());
+            }
+            catch (err) {
+                if (err instanceof RunConflictError && this.quarantined.size > quarantined)
+                    continue;
+                // A pending save may outlive its directory; never recreate it or hide live-directory
+                // failures. The rows stay pending (and held), so the next save or commit retries them.
+                if (existsSync(this.dataDir)) {
+                    const message = err instanceof Error ? err.message : String(err);
+                    console.error(`${logPrefix()} failed to save ${RUNS_DB_FILE}: ${message}`);
+                }
+                break;
+            }
+        }
+        if (evict)
+            this.evictSettled();
+    }
+    /**
+     * Write what is pending and release the database (store disposal, process shutdown).
+     * Idempotent. A closed store keeps answering reads for what it holds — the final save evicts
+     * nothing — but cannot read `runs.db` any more, so a run that had already left memory reads as
+     * absent. It saves nothing more, and a durable commit on it throws.
+     */
+    close() {
+        this.liveItems.clear();
+        // Demand-bound feeds stop before storage disappears during project removal/shutdown.
+        this.emit('closed');
+        this.compressor.stop();
+        this.fallbackFacts?.stop();
+        this.facts.stop();
+        this.facts.flush();
+        if (this.saveTimer) {
+            clearTimeout(this.saveTimer);
+            this.saveTimer = null;
+        }
+        this.saveNow(false);
+        if (this.db && this.owner) {
+            // Every claim goes with the store. Should the release fail, the claims stay until this
+            // process exits; from then on they are provably dead and the next opener takes them.
+            try {
+                this.db.releaseClaims(this.owner.session);
+            }
+            catch { /* see above */ }
+        }
+        this.claimed.clear();
+        this.pendingClaims.clear();
+        if (this.owner)
+            closeClaimSession(this.owner.session);
+        this.db?.close();
+        this.db = null;
+    }
+}
+function archiveDigest(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+function archiveFields(run, archived, now) {
+    stageArchiveFields(run, archived, now);
+}
+//# sourceMappingURL=store.js.map